A suspected theft involving $40 million+ tied to US government seizure wallets drew scrutiny after a young threat actor was recorded in a Telegram “band for band” flex, allegedly showing control of multiple crypto wallets and moving funds live during the argument.
The tracer identifies the persona as John Daghita (“Lick”) and frames the recording as unusually strong evidence of wallet control, because the screen share allegedly shows the same person operating the relevant wallets while funds are moved.
In the first segment of the recording, Daghita allegedly displays a Tron wallet holding roughly $2.3 million. That wallet is presented as his wallet and separate from the Ethereum wallets that become the focus later.
In the second segment, while the argument continues, about $6.7 million in ETH is shown moving into an Ethereum wallet the tracer attributes to Daghita’s control.
After the flex ends, the tracer claims Daghita moved about $23 million total into the same primary Ethereum wallet shown in the recording. That wallet is treated as the main “collection” wallet in the thread, with the tracer asserting the recording demonstrates John controls it.
The thread describes at least three distinct wallets under alleged common control:
- 1. One Tron wallet shown in the screen share (separate chain, separate wallet).
- 2. A primary Ethereum wallet where the tracer says John consolidated roughly $23 million (the main wallet).
- 3. A second Ethereum wallet that the tracer says fed funds into the primary Ethereum wallet, and which John allegedly confirmed owning during the recording.
From there, the tracer reconstructs an upstream chain: the secondary Ethereum wallet is said to have received a large WETH transfer on Nov. 20, 2025, coming from another Ethereum wallet the tracer connects to earlier activity.
Alleged link to US government seizure funds
The tracer claims one upstream Ethereum wallet received $24.9 million from a US government-controlled wallet in March 2024, tied to the Bitfinex hack seizure, and notes having flagged that same government-linked wallet behavior in Oct. 2024.
Separately, the tracer says the primary Ethereum wallet had $63 million+ in inflows during Q4 2025 from a mix of “suspected victims” and “government seizure addresses,” listing four large inflows in Nov. 2025 and Dec. 2025: $13.5 million, $15.4 million, $3.0 million, and $1.0 million.
The tracer also alleges an additional 4.17K ETH (about $12.4 million) came from an exchange (MEXC) and flowed into the same primary Ethereum wallet.
The most consequential allegation is access proximity: the tracer says Daghita’s father, Dean Daghita, owns Command Services & Support (CMDSS), described as holding an active government IT contract in Virginia and having been awarded work to support the US Marshals Service in managing or disposing of seized and forfeited crypto assets. The tracer explicitly states it remains unclear how Daghita obtained access via his father.
A contract listing shows, with a current option period end date of Jun. 1, 2031 and an ultimate contract end date of Jun. 1, 2036, the firm as a service-disabled veteran-owned small business and small business.
A separate excerpt recounts earlier controversy around the awarding, including a protest claiming CMDSS lacked required licensing and raising conflict concerns, while USMS asserted the contract did not require SEC or FINRA licensing and said it investigated conflicts.
Most recently, the tracer reported CMDSS’s X account, website, and LinkedIn were deactivated. Another update says Daghita resumed trolling shortly after.
A later update says Daghita sent the tracer 0.6767 ETH (about $1.9K) from the allegedly stolen pool, with the tracer stating any received stolen funds would be returned to a US government seizure address.
The tracer reported that Executive Director of the President’s Council of Advisors for Digital Assets, Patrick Witt, and USMS said they were looking into the incident.
Information for this story was found via Zero Hedge and the sources and companies mentioned. The author has no securities or affiliations related to the organizations discussed. Not a recommendation to buy or sell. Always do additional research and consult a professional before purchasing a security. The author holds no licenses.
