The $46 Million Crypto Heist: A Story of Betrayal and Digital Theft

When Trust Meets Temptation in Government Contracting

In a shocking case that highlights the vulnerabilities inherent in handling seized digital assets, John Daghita, who went by the online alias “Lick,” found himself in FBI custody after allegedly orchestrating one of the most brazen cryptocurrency thefts from the United States government. The arrest, which took place in the Caribbean, came after investigators pieced together evidence showing that Daghita had allegedly siphoned off approximately $46 million worth of confiscated cryptocurrency from the US Marshals Service. What makes this case particularly troubling is how the alleged theft occurred – not through sophisticated hacking from the outside, but rather through insider access gained via his father’s company, which had been entrusted with handling asset disposal for some of the most sensitive government agencies in the United States.

The story begins with what appeared to be a routine government contract awarded to Command Services & Support, Inc. (CMDSS), a technology company headed by Dean Daghita, John’s father. In 2024, this firm secured a contract to manage asset disposal operations for both the US Department of Justice and the Department of Defense – a responsibility that came with access to substantial amounts of seized cryptocurrency. These digital assets typically come from criminal investigations, drug busts, and other law enforcement operations where cryptocurrencies were used or accumulated through illegal means. The government regularly seizes such assets and eventually disposes of them, often converting them to traditional currency. John Daghita worked as an employee at his father’s company, positioning him perfectly to access these highly valuable digital holdings. According to allegations, he exploited this privileged position to redirect confiscated cryptocurrencies into his personal wallets, essentially stealing from the very government agency his family’s company was supposed to serve.

The Unraveling of a Digital Crime

For months, John Daghita apparently operated in the shadows, successfully moving millions of dollars worth of cryptocurrency without detection. His scheme might have continued indefinitely if not for a crucial mistake that many criminals eventually make: the overwhelming urge to brag about their success. On January 23, 2026, Daghita allegedly chose to share details of his exploits with another individual who had confessed to similar criminal activity – a person named Dritan Kapplani Jr. This conversation, which was recorded, proved to be the thread that unraveled the entire operation. During this exchange, Daghita revealed his wallet address, probably feeling secure in the anonymity that cryptocurrencies supposedly provide. However, he hadn’t counted on the investigative prowess of blockchain analysts like ZachXBT, an independent investigator who had previously gained recognition for exposing the Axiom insider trading scandal.

ZachXBT’s analysis became the key to cracking the case wide open. Using blockchain forensics tools and publicly available transaction data – one of the paradoxes of cryptocurrency is that while users can be anonymous, all transactions are permanently recorded on public ledgers – the investigator traced the wallet address Daghita had revealed back to several suspicious activities. The digital breadcrumbs led directly to a US Government address from which substantial amounts of digital assets had mysteriously disappeared in 2024. This connection provided law enforcement with the evidence they needed to move forward with the arrest. The case demonstrates both the transparency of blockchain technology and its limitations: while every transaction is recorded and traceable, identifying the real people behind wallet addresses requires additional investigative work, mistakes by the perpetrators, or both.

A Pattern of Vulnerability in the Crypto Space

Unfortunately, the Daghita case is far from an isolated incident in the cryptocurrency world. The digital asset industry has become a hunting ground for various types of theft, fraud, and exploitation, ranging from insider jobs like this alleged scheme to sophisticated technical attacks targeting individual users and organizations alike. The decentralized and largely unregulated nature of cryptocurrencies, combined with the irreversible nature of transactions and the difficulty in recovering stolen funds, creates an environment where criminals see opportunity and victims often have little recourse. This year alone has witnessed numerous high-profile security breaches and thefts that underscore the ongoing challenges facing the cryptocurrency ecosystem as it matures and seeks broader mainstream adoption.

One particularly concerning development this year was Apple’s warning to iOS users about the “Coruna” exploit, a malicious software specifically designed to hunt for cryptocurrency wallet seed phrases on infected devices. Seed phrases are essentially the master keys to cryptocurrency wallets – a series of words that provide complete access to all the digital assets stored in that wallet. If someone gains access to your seed phrase, they have full control over your cryptocurrency, and there’s typically no way to reverse unauthorized transactions. The Coruna malware targeted iPhones running iOS versions 13.0 through 17.2.1, though devices running iOS 18 or later were protected. Security researchers estimated that at least 42,000 devices were affected by this particular exploit, potentially compromising the cryptocurrency holdings of tens of thousands of users. The incident highlighted how even users of generally secure platforms like iOS can fall victim to targeted attacks, especially when they delay updating their operating systems.

When Government Agencies Become Victims Too

Perhaps most embarrassingly, even government agencies responsible for enforcing laws and protecting citizens have fallen victim to cryptocurrency security breaches. In a recent incident that sent shockwaves through South Korea’s financial and technology sectors, the country’s tax agency accidentally published its virtual asset wallet seed phrase online – essentially posting the keys to their cryptocurrency vault where anyone could find them. The result was predictably disastrous: the agency lost approximately $4.8 million worth of tokens before the error was discovered and corrected. This incident raises serious questions about the procedures and training that government agencies implement when handling digital assets, especially given the unforgiving nature of cryptocurrency transactions where mistakes cannot simply be reversed by calling a bank or credit card company.

These incidents collectively paint a picture of an industry still grappling with fundamental security challenges. From insider threats like the alleged Daghita scheme, to technical exploits targeting everyday users, to basic operational security failures by major institutions, the cryptocurrency ecosystem faces vulnerabilities at every level. The permanent and irreversible nature of blockchain transactions means that unlike traditional financial systems where fraudulent transactions can sometimes be reversed or funds recovered through insurance and legal processes, cryptocurrency thefts typically result in permanent losses. This creates higher stakes for security but also highlights the need for better education, more robust security protocols, and perhaps increased regulatory oversight to protect both individuals and institutions participating in the digital asset economy.

The Broader Implications and Path Forward

The arrest of John Daghita carries implications that extend far beyond one individual’s alleged crimes. For government agencies, the case represents a wake-up call about the challenges of managing seized digital assets and the critical importance of implementing security measures that account for insider threats. Traditional asset management procedures may be insufficient when applied to cryptocurrencies, where a single compromised password or seed phrase can result in instantaneous, irreversible losses of millions of dollars. Agencies handling confiscated digital assets will need to develop new protocols, possibly including multi-signature wallets that require multiple people to authorize transactions, regular audits of asset holdings, and stricter vetting and monitoring of contractors with access to sensitive systems.

For the cryptocurrency industry more broadly, cases like this underscore the ongoing tension between the decentralization and privacy that make digital assets attractive to many users, and the security and accountability that mainstream adoption requires. As cryptocurrencies move from the fringes of finance toward the mainstream, with institutional investors, government agencies, and ordinary citizens holding significant amounts of digital assets, the consequences of security failures become more severe. The industry must continue developing better security tools, educational resources, and perhaps frameworks for insurance and recovery that can provide users with some of the protections they’re accustomed to in traditional finance, without completely sacrificing the unique characteristics that make cryptocurrencies valuable. The path forward likely involves a combination of better technology, smarter regulations, improved education, and cultural changes that prioritize security without stifling innovation. Only by addressing vulnerabilities at every level – from individual user behavior to institutional protocols to the fundamental design of cryptocurrency systems – can the industry hope to reduce the epidemic of thefts and scams that currently plague the digital asset ecosystem.