An onchain investigation published by blockchain analyst ZachXBT has raised serious questions about the security and oversight of cryptocurrency seized by the United States government. The investigation centers on an individual known online as John or by the alias “Lick,” who allegedly accessed and controlled more than $90 million in digital assets tied to suspected thefts. According to the findings, some of the funds originated from wallets associated with U.S. government seizures and from unidentified victims between 2024 and 2025.
ZachXBT reported that the wallets under scrutiny may connect to CMDSS, a company owned by John’s father that held a contract with the U.S. Marshals Service to assist with the management and disposal of seized and forfeited digital assets. While the full method of access remains unclear, the reported wallet activity has prompted reviews by federal authorities and renewed attention on how government agencies safeguard digital assets.
Can We Go “Band for Band?”
The investigation began after recordings surfaced that showed John openly bragging about his cryptocurrency holdings in private online conversations. During one exchange, commonly referred to in cybercrime circles as a “band for band” challenge, John reportedly shared his screen and demonstrated control over multiple wallet addresses while funds moved in real time. Another participant in the exchange, identified as a separate threat actor, challenged John to prove the size of his holdings, which escalated into a heated and fully recorded interaction.
These recordings provided a starting point for onchain tracing. ZachXBT linked the displayed addresses to a network of wallets that received tens of millions of dollars from suspected victims and from addresses tied to government seizure activity. The tracing connected activity across several chains, including Ethereum and Tron, and showed large transfers occurring between November 2025 and December 2025.
According to the analysis, one wallet received more than $24 million from an address associated with a U.S. government seizure linked to the Bitfinex hack. Other wallets showed inflows totaling more than $60 million from suspected victims and government-linked addresses in late 2025. The recordings demonstrated John’s control over the wallets involved.
Alleged Ties to Government Seizures & Ongoing Investigations
Further scrutiny focused on CMDSS, a firm owned by John’s father that reportedly held an active federal IT contract in Virginia state. The company assisted the U.S. Marshals Service with the management of seized cryptocurrency assets. ZachXBT suggested that this relationship may explain how John gained access to sensitive wallets, though he emphasized that the precise mechanism remains unconfirmed.
Shortly after the investigation became public, John reportedly removed NFT usernames, changed his screen name, and altered his Telegram presence. Around the same time, CMDSS’s X account, website, and LinkedIn page were deactivated. These actions drew additional attention from the crypto community and raised further questions about internal controls and access management within firms that handle government digital assets.
ZachXBT also reported that John sent a small amount of $ETH from one of the alleged theft addresses to the investigator’s public wallet. ZachXBT stated that he intended to forward the funds to a government seizure address as part of his reporting to authorities.
The allegations have prompted responses from government officials. Patrick Witt, Executive Director for the U.S. President’s Council of Advisors for Digital Assets, publicly acknowledged the matter and stated that a review was underway.
The U.S. Marshals Service confirmed that it is investigating the claims. ZachXBT stated that he reported the findings and relevant wallet addresses to authorities for further action.
Suspect John “Lick” Seeks Attention, Launches $LICK Token
After reports linked John Daghita to the alleged theft of more than $40 million from U.S. government seizure wallets, onchain data and social media activity indicated that he launched a new token under the ticker name $LICK on the token creation platform pump.fun on January 27, 2025, and began livestreaming on Telegram, drawing attention from observers monitoring his online presence.
Pump.fun later removed the $LICK ticker name from its platform. Bubblemaps data indicates that wallets attributed to John control approximately 40% of the token’s total supply.
As of the time of writing, the token has been live for just over 2 hours and is now trading at a market cap below $200,000 after reaching a high of $2.1 million, a decline probably caused by its removal from the pump.fun platform.
Broader Concerns About Crypto Custody
The case has renewed attention on longstanding concerns about how seized cryptocurrency is stored, tracked, and managed. In 2022, the Department of Justice Office of the Inspector General warned that the U.S. Marshals Service lacked adequate policies for crypto storage, valuation, and disposal. The report cited conflicting guidance, inaccurate spreadsheets, and limited measures for tracking forked assets created during blockchain splits.
Later that year, the USMS acknowledged that it had lost control of two Ethereum wallets following a software update while seeking a contractor to help manage its crypto holdings. The agency stated that it was “unclear if the private key is incorrect, or the wallet malfunctioned,” and that contractors would attempt to resolve the problem or document recovery efforts.
As investigators continue to review allegations surrounding John “Lick” and CMDSS, the situation underscores the challenges public institutions face in handling decentralized digital assets. The outcome of the case may influence future policies, contractor oversight, and security standards for government-managed cryptocurrency.
Read More on SolanaFloor
Are Memecoins Making a Comeback? - $PENGUIN Memecoin Hits $160M All-time High Market Cap After White House X Post
Chinese-Canadian Trade Talks, Yen Inflation, and Yet Another Government Shutdown Spook Crypto Markets
It’s Alt Season for Metals!
