TRM Labs noted that authorities have detained John Daghita, who used the online handles “John” or “Lick,” in connection with the alleged theft of digital assets from wallets controlled by the United States government. TRM Labs pointed out that the operation unfolded on the Caribbean island of Saint Martin through a joint effort by French Gendarmerie tactical teams and FBI agents.
TRM Labs also mentioned in a blog post that FBI Director Kash Patel confirmed the arrest on social media, releasing photographs of recovered hardware wallets and a briefcase containing substantial amounts of U.S. cash.
The case originates from an October 2024 breach in which more than $20 million in cryptocurrency vanished from a federally managed wallet.
These holdings had been confiscated years earlier during the investigation into the 2016 Bitfinex exchange hack.
Federal investigators quickly recovered most of the missing value after direct outreach, yet a meaningful portion stayed unaccounted for.
Detailed blockchain examination later attributed roughly $24.9 million of those original seized funds to addresses under the suspect’s control.
Those addresses formed part of a larger cluster managing over $90 million in assets flagged for suspicious activity.
The investigation gained momentum thanks to blockchain researcher ZachXBT, who collaborates with TRM Labs.
In January 2026, ZachXBT publicly mapped transaction flows that traced back to the compromised government wallet.
Online discussions soon identified Daghita as the individual behind the activity.
His father, Dean Daghita, serves as president of Command Services & Support (CMDSS), a Virginia company awarded a U.S. Marshals Service contract in October 2024 to oversee custody and liquidation of specific categories of seized cryptocurrency.
This family link has drawn scrutiny regarding potential internal access to sensitive wallet systems.
A crucial piece of evidence surfaced from a January 2025 private Telegram conversation.
During a “band-for-band” exchange—where participants display real-time wallet balances—the user “Lick” screen-shared an Exodus wallet showing a TRON address holding approximately $2.3 million.
Moments later, roughly $6.7 million worth of ether was transferred into an Ethereum address, consolidating around $23 million into a single location.
After ZachXBT’s disclosures, the suspect moved funds across multiple blockchains and routed them through mixing services and other obfuscation tools in an effort to break the audit trail.
FBI cryptocurrency specialists, drawing on advanced tracing methods, successfully de-mixed several layers and identified consolidation points and potential exit ramps.
The episode demonstrates how public-private partnerships and immutable ledger records can overcome even sophisticated concealment tactics.
TRM Labs, which supported the probe with real-time intelligence, emphasized the importance of proactive collaboration through platforms like the TRM Beacon Network.
Ali Comolli, TRM Labs Global Capacity Building Lead and a former FBI analyst and prosecutor, observed that blockchains retain permanent transaction histories and that federal agencies have become exceptionally skilled at following cryptocurrency trails.
He expects forfeiture proceedings to begin promptly to restore the assets to their rightful owners, potentially supporting national digital asset initiatives such as the Strategic Bitcoin Reserve referenced in a March 2025 executive order.
This arrest highlights persistent risks in the management of seized digital assets and the determination of law enforcement to pursue offenders across borders. As the investigation continues, attention will focus on tracing remaining funds and reinforcing safeguards for government-held cryptocurrency.
TRM Labs concluded that the case serves as a reminder that attempts to exploit official contracts for personal enrichment face considerable countermeasures in today’s digital economy.
