John Daghita arrested on suspicion of stealing $46 million in cryptocurrency assets.
Key points of the incident : On the evening of March 5, 2026, John “Lick” Daghita, the son of a U.S. federal contractor, was arrested in St. Martin, Caribbean Island, on suspicion of stealing more than $46 million in crypto assets from the U.S. Marshals Service. The case was carried out jointly by the FBI and elite tactical units of the French Gendarmerie. At the time of his arrest, Daghita was carrying a metal briefcase containing bundles of hundred-dollar bills, multiple hard drives, and security keys. (Decrypt )
This is a victory for on-chain investigative efforts in the crypto industry: after on-chain detective ZachXBT exposed the case in January, US authorities intervened swiftly, ultimately leading to his arrest. The incident highlights the security vulnerabilities of government-held crypto assets and the risks of contractors abusing their access privileges. AMBCrypto
Event Timeline
| date | event | Key details |
|---|---|---|
| 2024 | Bitfinex hack incident: funds seized | The US government seized the relevant crypto assets, which were subsequently managed by CMDSS. (Decrypt ) |
| January 2026 | ZachXBT Exposed | The release of group chat logs and on-chain data shows Daghita boasting to others about stealing funds and transferring $23 million in ETH as proof of ownership. The U.S. Marshals Service has launched an investigation. (Decrypt AMBCrypto) |
| Evening of March 5, 2026 | Daghita arrested | Arrested in St. Martin, FBI Director Kash Patel announced the arrest on the X platform, emphasizing international cooperation in combating fraud. |
| 2026-03-05 | ZachXBT confirmed | He claimed the arrest stemmed directly from his investigation and mocked Daghita's previous "dusting" attack (sending small sums of money to his wallet to frame him ). |
Timeline analysis : The mere two months between ZachXBT's exposure and arrest demonstrates the efficiency of on-chain tracking and law enforcement cooperation. Dean Daghita's father, Dean Daghita, led CMDSS, a company that provides services to the Department of Justice, the Department of Defense, and others, including crypto asset management, potentially providing his son with access to these institutions. Decrypt
Case details and evidence
- Scale of theft : Over $46 million , mainly in assets such as ETH, some traceable to funds seized by the government in the 2016 Bitfinex hack (losses exceeding $1 billion).
- Modus operandi : Daghita used government contract access to her father's company, CMDSS, to transfer funds. Telegram group chats released by ZachXBT show her boasting to fellow hackers and multiple wallet transfers proving the authenticity of the funds.
- Subsequent actions : After the exposure, Daghita mocked ZachXBT on Telegram and sent a small amount of money as "dusting" in retaliation, but this only intensified the pursuit.
- Current Status : No formal details of the charges or information on the recovery of funds have been released. The U.S. Marshals Service is responsible for managing seized assets, and this case exposes loopholes in outsourced custody. AMBCrypto
Why this is important : The US government holds a large amount of seized crypto assets (over $1.1 billion in BTC in the Bitfinex case), managed by contractors. This highlights the risk of private key misuse and may drive stricter custody standards, such as multi-signature or self-custody solutions. This case also validates the value of on-chain detectives like ZachXBT, promoting industry transparency.
Wider impact
Government Crypto Asset Management Risks
| Risk points | describe | Revelation |
|---|---|---|
| Contractor visits | CMDSS and other companies handle sensitive assets | Access control audits and background checks need to be strengthened. |
| On-chain tracing | Public exposure of transfer behavior | Government wallets require coin mixing or bridging protection, but compliance challenges are significant. |
| International pursuit | Transnational Operations on Saint Martin | The FBI emphasizes 24/7 international cooperation. |
Market perspective : The event did not directly affect crypto prices, but it reinforced the narrative of "government holdings." If the funds are recovered, it could lead to selling pressure on ETH. Currently, there is no evidence that the funds have been laundered or entered the market. Decrypt
Compared with other cases
South Korean police arrested a phishing ring on March 21st that stole $602,000 in USDT, a case different from this one (smaller scale, phishing, not an inside job). Enforcement in Asia is becoming stricter, but the US case highlights the issue of institutional-level safekeeping. ( Bitcoinworld )
Data Limitations and Outlook
- Available data : Based on the latest report on March 5, there are no further court details or updates on fund flows (current time: 2026-03-05 16:17 UTC).
- Missing information : exact charges, amount recovered, CMDSS response. For real-time on-chain tracking or court proceedings, it is recommended to monitor ZachXBT or FBI announcements.
Conclusion : John Daghita's arrest signifies law enforcement's zero-tolerance policy towards crypto theft, and the ZachXBT investigation played a crucial role. This case serves as a warning to governments and institutions to strengthen asset custody, driving the industry towards more secure, multi-layered protection. While there may be no short-term market impact, it could lead to upgrades in custody standards in the long term.