On-chain sleuth ZachXBT discovered exactly how the attacker gained access to government funds. John “Lick” Daghita turned out to be the son of an IT company owner that officially services the US government.
While John was flexing his millions to opponents in a group chat, analysts were asking the big question: how did a 20-year-old guy drain funds from super-secure government wallets? The answer proved to be mundane.
John’s father, Dean Daghita, owns the company CMDSS (Command Services & Support, Inc). This firm holds an active government contract in Virginia. The main task of CMDSS is to help the US Marshals Service (USMS) manage confiscated cryptocurrencies and dispose of them.
Essentially, the government hired the father’s company to guard funds seized from criminals, and the owner’s son, taking advantage of his family connections, stole these funds. The theft involves over $40 M from addresses controlled by USMS.
It remains unclear how exactly John accessed his father’s official data — whether he cracked a workstation or simply peeked at passwords — but the assets flowed directly from the accounts administered by CMDSS.
The scheme unraveled after a petty flex on Telegram. On January 23, John entered a heated dispute with user Dritan Kapplani Jr. To prove his financial dominance, he enabled screen sharing and revealed assets totaling $23 M.
ZachXBT instantly linked these wallets to funds stolen from the US government (the Bitfinex case) and other victims in late 2025. Now that the connection through CMDSS is established, this case escalates from a routine hack into a massive scandal regarding federal contractor negligence.
This post is for informational purposes only and does not constitute advertising or investment advice. Please do your own research before making any decisions.
