ZachXBT Traces Suspect to U.S. Seizure Funds

Blockchain investigator ZachXBT has published new allegations linking a threat actor known as John (Lick) — possibly identified as John Daghita — to more than $90 million in suspected crypto thefts, including funds tied to U.S. government seizure addresses.

Loading tweet...

— View original post

Recorded Confrontation

According to ZachXBT, John was baited into a “band for band” (b4b) contest in a cybercrime group chat with another actor, Dritan Kapplani Jr.. During the exchange, John allegedly screenshared wallets showing $2.3M in Tron and later moved $6.7M in ETH into a separate address. By the end of the recording, John had transferred roughly $23M to the wallet 0xd8bc, which ZachXBT traced back to inflows from suspected victims and government seizure accounts.

On‑Chain Links

ZachXBT’s analysis ties 0xd8bc to earlier addresses, including 0x8924 and 0xc7a2, which received $24.9M from a U.S. government address in March 2024 related to the Bitfinex hack seizure. Additional inflows totaling $63M+ were linked to November and December 2025 transactions, alongside a recent 4,170 ETH ($12.4M) transfer from MEXC.

Alleged Connection to Government Contractor

In a follow‑up, ZachXBT alleged that John’s father owns CMDSS, a Virginia‑based IT contractor with an active U.S. Marshals Service contract to manage seized crypto assets. While it remains unclear how John may have accessed government‑linked funds, CMDSS’s X account, website, and LinkedIn were reportedly deactivated shortly after the allegations surfaced.

Outlook

ZachXBT claims John later sent him 0.6767 ETH ($1.9K) from the wallet in question, which he pledged to forward to a U.S. government seizure address. If verified, the recordings and wallet traces could provide law enforcement with direct evidence of control over addresses tied to stolen funds.