Loading story…
US authorities arrested John Daghita, a U.S. government contractor, on allegations he stole more than $46 million in cryptocurrency tied to wallets associated with the U.S. Marshals Service (USMS). The apprehension occurred on the Caribbean island of Saint Martin in a coordinated operation involving the FBI and French law enforcement units (including the French Gendarmerie), and was publicly confirmed by FBI Director Kash Patel, who also shared images of seized items reportedly including hardware wallets and cash.
Reporting and blockchain-tracing details indicate the theft activity was linked to a persona using the handles “John” / “Lick,” with on-chain movements drawing attention after a public “band-for-band” social media exchange; after attribution, the actor allegedly attempted to launder remaining proceeds via mixers and cross-chain transfers. The case has been highlighted as a high-impact insider threat scenario involving access to or association with a firm responsible for safeguarding seized digital assets, underscoring the need for strong access controls, contractor oversight, and monitoring around government-controlled cryptocurrency custody.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On March 5, 2026, FBI Director Kash Patel publicly confirmed the arrest and said it reflected the bureau's commitment to pursuing fraud against U.S. taxpayers. The case was presented as a major insider-theft investigation involving government-controlled digital assets.
On March 4, 2026, U.S. government contractor John Daghita was arrested on the Caribbean island of Saint Martin for allegedly stealing cryptocurrency tied to the U.S. Marshals Service. The arrest was carried out through international coordination between the FBI and French Gendarmerie units, including GIGN.
Following the January 2026 attribution, the actor allegedly moved funds through mixers and across blockchains in an attempt to obscure their origin. Investigators continued tracing the transactions despite those laundering efforts.
In January 2026, blockchain investigator ZachXBT publicly connected the online personas 'John' and 'Lick' to wallets moving funds associated with the earlier government-wallet theft. The attribution followed observation of a Telegram 'band-for-band' exchange in which the actor screen-shared wallet activity and consolidated large balances.
In October 2024, attackers allegedly stole more than $20 million in cryptocurrency from a wallet controlled by the U.S. government and associated with the U.S. Marshals Service. The theft highlighted insider-risk concerns around custody of seized digital assets.
After the October 2024 theft, FBI outreach helped recover most of the stolen cryptocurrency, though some assets remained unrecovered. The exact recovery date was not specified in the references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcetrmlabs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US authorities arrested **John Daghita** (online handle **“Lick”**) in Saint Martin for allegedly stealing **more than $46 million** in cryptocurrency tied to the **U.S. Marshals Service (USMS)**. The arrest was conducted in a joint operation between the **FBI** and France’s **Groupe d’Intervention de la Gendarmerie Nationale (GIGN)**, and reportedly involved the seizure of cash, hard drives, and security keys. Reporting links Daghita to a USMS digital-asset management contractor (CMDSS), and notes that blockchain investigator **ZachXBT** publicly traced USMS-linked wallet movements to addresses he associated with Daghita, helping bring attention to the alleged theft. Separately, South Korea’s **National Tax Service** reportedly lost roughly **$5 million** in seized cryptocurrency after officials circulated a press release that exposed a wallet’s **mnemonic recovery phrase/password**, enabling an unknown party to drain the funds. The incident was described as part of a broader pattern of **crypto custody lapses** in South Korean law enforcement, with additional cases cited involving missing seized bitcoin and investigations tied to potential phishing and internal control failures. Together, the incidents underscore that government-held digital assets remain a high-value target and that operational security failures (credential exposure, weak key management, and inadequate redaction/review processes) can directly translate into rapid, irreversible losses.
Jun 29, 2026
US authorities reported multiple enforcement actions tied to **crypto-enabled crime**. In the Empire Market case, prosecutors said co-creators **Raheim Hamilton** and **Thomas Pavey** designed the dark web marketplace to help users evade law enforcement and launder proceeds; the market allegedly facilitated about **$430M** in transactions (drugs, stolen payment data, counterfeit currency) before disappearing in 2020 in what investigators described as an exit scam that stole an estimated **$30M** in bitcoin. Hamilton pleaded guilty to federal drug conspiracy charges and agreed to forfeit roughly **1,230 BTC** plus **24.4 ETH** and real estate; Pavey previously pleaded guilty and agreed to forfeit about **1,584 BTC** and other assets. Separately, reporting highlighted alleged misuse and laundering of digital assets in other contexts. On-chain investigator **ZachXBT** traced movements from wallets associated with **US-seized crypto** (held under U.S. Marshals Service custodianship) to wallets allegedly linked to **John Daghita**, the son of a federal contractor executive, with claims of roughly **$23M** in diverted cryptocurrency and another wallet holding about **$36M** in Ethereum; ZachXBT said he alerted the **U.S. Marshals Service**. In another DOJ case, **Jingliang Su** (a Chinese national) was sentenced to **46 months** for laundering proceeds from a cryptocurrency investment fraud that authorities said victimized **174** people for **$36.9M**, using social engineering via social media/dating platforms and counterfeit trading sites, with **$26.9M** restitution ordered and multiple US agencies involved in tracing funds and dismantling the network.
Jun 29, 2026
U.S. prosecutors and courts advanced multiple cases tied to large-scale cryptocurrency fraud and laundering operations that targeted American victims through fake trading platforms and social-engineering lures. In one California case, **Jingliang Su**, a Chinese national, was sentenced to 46 months in prison after admitting he helped launder more than **$36.9 million** stolen from 174 victims by a scam network operating from Cambodia; the court also ordered more than **$26.8 million** in restitution. Authorities said the fraud used unsolicited messages, calls, texts, dating platforms, and bogus crypto-investment websites to persuade victims to transfer funds, which were then routed through U.S. shell companies, bank accounts, Deltec Bank in the Bahamas, and **Tether (`USDT`) wallets** controlled abroad. In a related prosecution, **Daren Li**, a dual citizen of China and St. Kitts and Nevis, pleaded guilty to conspiracy to commit money laundering after authorities said he and co-conspirators moved more than **$73 million** in victim proceeds through shell companies, U.S. financial accounts, wire transfers, and conversion into `USDT`; he was later sentenced to **20 years in federal prison**. The cases form part of a broader Justice Department crackdown on transnational crypto-enabled investment scams and money-laundering networks, with officials reporting that multiple co-conspirators have pleaded guilty and that the U.S. Secret Service played a central investigative role.
Jun 29, 2026