Blockchain sleuth ZachXBT has published new findings alleging that a threat actor known as John (Lick) — possibly identified as John Daghita — controls wallets tied to more than $90 million in suspected crypto thefts, including funds linked to U.S. government seizure addresses.
Band‑for‑Band Recording
The revelations stem from a leaked “band for band” (b4b) contest in a cybercrime group chat, where John clashed with fellow actor Dritan Kapplani Jr. over wallet balances.
During the exchange, John allegedly screenshared his Exodus wallet showing $2.3M in Tron, then moved $6.7M in ETH into a second address. By the end of the recording, roughly $23M had been consolidated into the wallet 0xd8bc, which ZachXBT traced to inflows from suspected victims and government seizure accounts.
On‑Chain Trail
Analysis links 0xd8bc to earlier addresses, including 0x8924 and 0xc7a2, which received $24.9M from a U.S. government wallet in March 2024 related to the Bitfinex hack seizure. Additional inflows totaling $63M+ were tied to November and December 2025 transactions, alongside a recent 4,170 ETH ($12.4M) transfer from MEXC.
Alleged Contractor Connection
In a follow‑up, ZachXBT alleged that John’s father owns CMDSS, a Virginia IT contractor with an active U.S. Marshals Service contract to manage seized crypto. While it remains unclear how John may have accessed government‑linked funds, CMDSS’s website and social accounts were reportedly deactivated shortly after the allegations surfaced.
Outlook
ZachXBT claims John later sent him 0.6767 ETH ($1.9K) from the wallet in question, which he pledged to forward to a U.S. government seizure address. If verified, the recordings and wallet traces could provide law enforcement with direct evidence of control over stolen funds.
