Blockchain Investigator Identifies Crypto Theft Network Linked to US Government Seizure Funds

Blockchain investigator ZachXBT has identified a network of wallets linked to over USD 90 million in suspected illicit cryptocurrency activity, including USD 24.9 million from a US government-controlled wallet tied to the 2016 Bitfinex hack. The user, known as "John" or "Lick," allegedly consolidated assets through a combination of centralized exchanges, bridges, and decentralized platforms to obscure the origin of the funds according to investigation findings.

The findings emerged from real-time observation during a private Telegram exchange where the user screen-shared wallet activity, enabling ZachXBT to directly attribute control of the assets. The consolidation of funds included USD 23 million into a single wallet, a move indicative of deliberate laundering and reconsolidation as reported.

ZachXBT traced the funds back to a US government-controlled wallet that had received assets from the Bitfinex hack. Anomalous activity from that wallet had previously been flagged in October 2024, when USD 20 million was drained, with most of it reportedly returned within 24 hours according to data.

The user's alleged connection to Dean Daghita, president of Command Services & Support (CMDSS), a firm contracted by the U.S. Marshals Service to assist with seized cryptocurrency, has not been substantiated. CMDSS confirmed that Dean Daghita is the company's president, but no official action has been taken against him.

Why Did This Happen?

ZachXBT's investigation was enabled by the user's participation in a "band-for-band" exchange on Telegram, where users attempt to prove their wealth by displaying and moving cryptocurrency in real time. In this case, the user known as "Lick" screen-shared an Exodus wallet, demonstrating control over USD 2.3 million in TRON and USD 6.7 million in ether. By the end of the exchange, USD 23 million had been consolidated into one wallet.

The live nature of the transactions allowed ZachXBT to observe wallet control, transaction hashes, and consolidation behavior, leading to high-confidence attribution of the user to the funds. The activity is consistent with known laundering techniques involving multiple wallet hops, exchanges, and cross-chain mechanisms as analysis shows.

How Did Markets React?

ZachXBT's public disclosure of the investigation on January 23, 2025, marked an unusual move, as such cases typically rely on covert tracing and legal processes. The exposure of alleged control over government-linked funds is rare in the cryptocurrency space and suggests a growing role for public accountability in digital asset investigations.

TRM Labs, which works closely with law enforcement and investigative partners, highlighted the importance of blockchain intelligence in supporting attribution and disrupting illicit activity. The Beacon Network enables real-time collaboration between investigators, authorities, and service providers to flag suspicious transactions quickly.

What Are Analysts Watching Next?

The case underscores the risks of overconfidence and operational errors in cryptocurrency laundering. Despite sophisticated tactics, the immutable nature of blockchain records can allow investigators to reconstruct complex financial activity. Analysts are watching for potential regulatory responses and how law enforcement agencies may adapt to the increasing transparency provided by blockchain analytics.

The implications for oversight and enforcement are significant. Any movement of government-controlled funds is likely under active monitoring, and the public exposure of such alleged activity raises questions about the integrity of custodial services. As the industry evolves, the use of blockchain intelligence is expected to play a central role in identifying and mitigating illicit activity.