FBI Arrests Suspect Linked to $46M Crypto Theft From U.S. Marshals Wallets

Highlights:

• U.S. authorities arrest John Daghita for allegedly stealing $46M from U.S. Marshals’ crypto wallets.
• ZachXBT links suspect alias “Lick” to transfers moving tens of millions in cryptocurrency.
• International operation in Saint Martin leads to arrest, seizure of cash, hard drives, and security keys.

United States authorities arrested John Daghita, the son of a federal contractor, for allegedly stealing $46 million in cryptocurrency from the U.S. Marshals Service. The arrest took place on Saint Martin in a joint operation with the FBI and French police. 

ZachXBT Flags Suspicious Transfers From Government Crypto Wallets

In a March 5 post on X, the FBI Director Kash Patel said Daghita was caught with help from the French Gendarmerie’s Serious Crime Unit and the Groupe d’intervention de la Gendarmerie nationale of Guadeloupe. Authorities say 22‑year‑old Daghita used his access to U.S. Marshals Service wallets to move large amounts of crypto into addresses he controlled. The stolen funds included government‑seized assets, including holdings linked to major cases like the 2016 Bitfinex hack.

Last night, John Daghita – a U.S. government contractor who allegedly stole more than $46 million in cryptocurrency from the U.S Marshals Service – was arrested on the island of Saint Martin by the French Gendarmerie’s premier elite tactical unit in a joint operation with the… pic.twitter.com/3ttochgbjk

— FBI Director Kash Patel (@FBIDirectorKash) March 5, 2026

Blockchain investigator ZachXBT first raised concerns in January after noticing unusual activity on government-linked crypto wallets. In a public post, he connected William Daghita, who allegedly used the online alias “Lick,” to several transfers that moved tens of millions of dollars in cryptocurrency. On-chain data reportedly showed that a wallet linked to the suspect held more than 12,500 Ethereum (ETH), valued at roughly $36 million at the time.

Update: Update: John (Lick) sent me 0.6767 ETH ($1.9K) of the stolen government funds from 0xd8bc to my public wallet address.

Transaction hash
0x90539e91fbebd0aaa050a492548b1e3b1bc7d82dd84bf8a42a9595a90425ebfa

(Any stolen funds received will be sent to a USG seizure address) https://t.co/L0zf7s6mVl pic.twitter.com/FUpquhjuab

— ZachXBT (@zachxbt) January 26, 2026

Further analysis revealed that Daghita may have taken advantage of his connection to Command Services & Support (CMDSS), a Virginia-based contractor. The company’s chief executive is his father, Dean Daghita. Previously, CMDSS secured a contract with the U.S. Marshals Service to assist in managing and liquidating digital assets that had been seized by the agency. Investigators believe weak internal controls within the system created an opportunity for the alleged theft. 

Investigators found that Daghita moved cryptocurrency out of government custody. He reportedly routed some transfers through cryptocurrency exchanges and several intermediary wallets to hide the transaction trail and make tracking more difficult.

International Operation Leads to Arrest in Saint Martin

During the operation in Saint Martin, law enforcement arrested the suspect and seized several items connected to the case. Authorities recovered cash, hard drives, and security keys that investigators believe link directly to the alleged theft. The FBI said the case shows its determination to pursue anyone who defrauds U.S. taxpayers, regardless of where they try to hide.

Investigators carried out the arrest after months of coordination with international law enforcement and detailed analysis of public blockchain transactions. According to sources familiar with the investigation, Daghita also bragged about his activities in private messaging channels. He allegedly sent small amounts of the stolen cryptocurrency to different wallets, a tactic known as “dusting,” which criminals sometimes use to test transactions or confuse investigators tracking funds on the blockchain.

What Comes Next

Federal prosecutors are preparing to file formal charges against Daghita. The charges may include theft of government property, wire fraud, and money laundering. In the coming weeks, the case will move into the legal process as investigators work to determine the full scale of the alleged theft and attempt to recover the stolen digital assets.