Blockchain investigator ZachXBT linked a threat actor to more than $90 million in suspected cryptocurrency thefts from U.S. government seizure addresses, allegations that raise questions about custody procedures at the U.S. Marshals Service.
The individual, identified as "John" or "Lick," allegedly controlled wallets connected to government-held assets from the 2016 Bitfinex hack case.
ZachXBT's investigation surfaced after a recorded online dispute where the suspect demonstrated control over $23 million in cryptocurrency during a "band for band" flex with another alleged criminal.
Blockchain analysis traced funds backward through multiple wallets to a U.S. government address that received $24.9 million from Bitfinex seizure proceeds in March 2024.
USMS Contract and Custody Concerns
Command Services & Support, Inc. won the U.S. Marshals Service contract in October 2024 to manage Class 2-4 seized cryptocurrency assets.
The Virginia-based technology services firm defeated Coinbase competitor Wave Digital Assets in a contested procurement process.
Dean Daghita, president of CMDSS, operates the company from Haymarket, Virginia. Government contract documents show the firm holds a multi-year agreement running through June 2036 to assist USMS in managing and disposing of forfeited digital assets.
Wave Digital Assets previously challenged the contract award, alleging CMDSS lacked proper Securities and Exchange Commission or Financial Industry Regulatory Authority licensing.
The Government Accountability Office denied Wave's protest in March 2025, finding USMS evaluation procedures reasonable.
Read also: Why McLaren Racing Chose Hedera Over Ethereum For Fan Collectibles
Unverified Access Claims
ZachXBT suggested a possible family connection between the alleged thief and CMDSS ownership, though this relationship remains unverified through independent sources.
How the suspect allegedly obtained access to government-controlled wallets has not been established.
The suspect reportedly removed identifying information from social media accounts and changed Telegram usernames following ZachXBT's public investigation. Approximately $18.5 million allegedly remains in wallet address 0xc7A253fD3C61CF69d043e6184c107dF4E29475B5 as of January 23.
Neither USMS nor CMDSS responded to inquiries. The Department of Justice has not announced charges related to the alleged theft.
Read also: MoonPay Secures Eight-Figure X Games Title Sponsorship As League Format Launches