John Daghita: Charged With Stealing $46M in Seized Crypto From the US Marshals

On the night of 4 March 2026, a tactical unit of France's Gendarmerie walked into a luxury villa on the Caribbean island of Saint Martin and arrested a 21-year-old American. Inside, according to US prosecutors, were $239,348 in US cash, a Rolex GMT-Master II, a Chrome Hearts duffel bag and several Trezor and Ledger hardware wallets, small USB-sized devices that store the secret keys to cryptocurrency.

The American was John Dean Daghita, known online as "Lick". The money, prosecutors say, belonged to the United States government. A federal grand jury in Alexandria, Virginia, has charged him with 15 counts, accusing him of taking $46,114,909.46 in digital assets in 29 transfers between 15 December 2025 and 23 January 2026. The assets had been seized from criminals and handed to a small Virginia contractor to store and sell for the US Marshals Service. The contractor's president is his father. Daghita has not entered a plea and has not been convicted of anything.

Why the government holds crypto at all

When police seize a drug dealer's car or a fraudster's house, somebody has to look after it until a court decides who owns it, and then sell it. For most federal cases that somebody is the US Marshals Service, the Justice Department agency best known for chasing fugitives. Under the asset forfeiture programme Congress created in 1984, the proceeds pay victims and fund law enforcement. Crypto seized in hacks, darknet cases and fraud goes the same way, and the Marshals' Complex Assets Unit is its main custodian. Since President Donald Trump's March 2025 executive order, forfeited bitcoin has also been earmarked for the government's Strategic Bitcoin Reserve.

Crypto is harder to guard than a car. A holding is not an account at a bank. It is a balance recorded on a blockchain, a public ledger anyone can read, and it moves when someone uses the matching private key, a long secret number that works like the only key to a safe deposit box and the signature on every cheque at once. There is no bank to ring and no transfer to reverse. Custody, in crypto, simply means who holds the keys. Anyone who holds them can move the money, which is why a trusted insider is the entire risk.

In October 2024 the Marshals awarded a managed services contract to a small firm in Haymarket, Virginia, to take custody of and sell what the government calls "Class 2 through Class 4" assets, the less mainstream tokens that need specialist wallets. Court papers call the firm "Company A". CoinDesk, TRM Labs and others identify it as Command Services & Support (CMDSS), whose president is Dean Daghita. Fortune reported the contract was worth about $4 million. A losing bidder, Wave Digital Assets, argued the firm lacked the right licences; the Government Accountability Office rejected that protest in March 2025.

How the theft allegedly worked

CMDSS hired John Daghita in January 2025 with the title "Cryptocurrency Subject Matter Expert". From July 2025 the Marshals began sending assets to company wallets, and he was the project lead: the person who actually executed transfers, swaps and sales. Staff were supposed to handle the assets only on computers in the company's Arlington office. Nothing in the filings says his access changed.

On 15 December 2025, the indictment says, he made three transfers worth about $5 million into wallets he controlled. The Marshals saw the money move and assumed the company was tightening security, because Daghita had told them he wanted to put assets into separate multi-signature wallets, accounts that need several approvals to spend, like a company cheque that needs two directors to sign. The Marshals asked for the shared records to be updated. They never were.

Within days, prosecutors say, the money was being spent. A payment of $773,892 covered a New Year's Eve trip to Saint Barthelemy. Another of $719,720 went toward a 2019 Lamborghini Aventador SVJ. On 13 January 2026 he left Miami for the Caribbean on a chartered boat, paid for with $179,888 in USDT, a stablecoin, or digital dollar.

©CMZ chart. Source: indictment, US v. Daghita

On 22 January the Marshals asked the company to send back about $2 million of crypto. Twenty minutes later, the FBI affidavit says, it went to an address the government did not own. Over 22 and 23 January roughly $41 million more followed, including $12.4 million in FDUSD and $13.6 million in BUSD, two more digital dollars, and $3.7 million in wrapped ether, the Ethereum network's own coin in a standard wrapper so trading software can handle it.

©CMZ chart. Source: FBI affidavit

A theft on camera

Part of it, the FBI says, was filmed by the accused himself. In January, according to the affidavit, a user named "john" shared his screen on a Brave Talk video call with a group chat named "chinese communist party". This was a "band for band", a contest in which online thieves prove who is richer by showing their balances live. In about nine minutes of video, "john" used CoW Swap, a trading website, to convert 1,066 wrapped ether that the Marshals had sent the company in November, then moved 1,011 ether into his own Exodus wallet. The balance on screen jumped from $6.2 million to $9.18 million. Someone in the chat posted a photograph, which Daghita's family later identified as him.

The recordings spread on X, and blockchain investigator ZachXBT traced them, named Daghita and linked him to his father's firm. ZachXBT also alleged that wallets tied to "Lick" had held about $90 million, including funds from other victims, and connected them to an October 2024 drain of about $20 million from a government wallet, most of it returned within a day. TRM Labs, a blockchain analytics firm, traced $24.9 million of the funds to a government wallet holding coins seized over the 2016 Bitfinex hack. None of those earlier episodes appears in the charges, and the filings say the company only began receiving Marshals assets in July 2025.

The FBI was alerted on 23 January. The next day the company's owner told agents he had authorised none of the transfers. On 25 January, the affidavit says, Daghita told a relative on Telegram to "chill" because "the feds are watching the channel", then deleted the message. His own Telegram channel posted "file a report now to help law enforcement catch me". On 26 January, the indictment says, he spent about $2.2 million in ether on three Telegram usernames: "@devil", "@skid" and "@fraud". On 27 January he sent four payments of $301,711.20 each into Tornado Cash, a mixer that pools many users' coins so the trail is hard to follow. A sealed criminal complaint was filed on 30 January.

Arrest and where the case stands

After leaving the country, prosecutors say, he paid for a private yacht, the six-bedroom villa, a bodyguard and a private chef. The villa is where the Gendarmerie's GIGN tactical unit from Guadeloupe found him, in a joint operation with the FBI's Washington Field Office. FBI Director Kash Patel announced the arrest on X the next day, saying the bureau would pursue people who "defraud American taxpayers, no matter where they try to hide". French reports said officers also found a handgun and phones.

The 15-count indictment, filed on 26 March, charges four counts of wire fraud, one of theft of public money, four of money laundering (the Tornado Cash deposits) and six of unlawful monetary transactions (the Lamborghini, the trip, the boat and the usernames). The case sits before US District Judge Rossie D. Alston Jr. Each wire fraud and money laundering count carries a maximum of 20 years. Prosecutors are seeking forfeiture of at least $46,114,909.46, plus the car, the cash, the Rolex and the hardware wallets.

On 21 May Daghita appeared before the investigating chamber of the Court of Appeal in Basse-Terre, Guadeloupe, and agreed to be sent home. His lawyer, Marie-Pierre Saget-Jolivière, told local press he was "ready to return to the United States". The court approved extradition on 28 May. As of late September, the public court record in Alexandria shows no filing after the indictment and no plea.