On Wednesday, the FBI put an end to the escape of John Daghita, known in digital circles under the pseudonym 'Lick'. The man, the son of a prominent US government contractor, was arrested on the Caribbean island of Saint Martin on charges of embezzling more than $46 million in cryptocurrency from the United States Marshals Service (USMS).
The operation is the culmination of a blitzkrieg investigation that began last January, triggered by revelations from renowned on-chain investigator ZachXBT, who had tracked the suspicious movements of government funds long before authorities made the charges official.
The role of CMDSS and the abuse of power
At the centre of the scandal is Command Services & Support (CMDSS), a Virginia-based IT company owned by Daghita's father. Despite its small size, CMDSS is a long-standing partner of the government, with active contracts at the Department of Defence and the Department of Justice.
Last night, John Daghita - a US government collaborator who allegedly stole over $46 million in cryptocurrency from the US Marshals Service - was arrested on the island of Saint Martin by the elite tactical unit of the French Gendarmerie, in a joint operation with the FBI, as stated by Kash Patel in a post on X.
Last night, John Daghita - a U.S. government contractor who allegedly stole more than $46 million in cryptocurrency from the U.S Marshals Service - was arrested on the island of Saint Martin by the French Gendarmerie's premier elite tactical unit in a joint operation with the... pic.twitter.com/3ttochgbjk
- FBI Director Kash Patel (@FBIDirectorKash) March 5, 2026
In 2024, the company was awarded a crucial contract: to assist US Marshals in the management and safekeeping of cryptographic assets seized and confiscated during police operations.
According to initial reconstructions, Daghita allegedly exploited his father's privileged position to gain access to the private addresses of government digital wallets. Although the technical details of the breach are still not entirely clear, the scale of the theft is unprecedented for a federal agency.
The Digital Tracks: Between Bravado and Meme Coin
The investigation by ZachXBT revealed that at least $23 million went directly into a wallet traceable to Daghita. This same wallet is suspected to be linked to a much larger theft ring, estimated at over $90 million, against the government and other victims between 2024 and the end of 2025.
Daghita's behaviour after the theft was described as provocative. The suspect allegedly used his Telegram channel to taunt ZachXBT, even going so far as to send small amounts of stolen cryptocurrency to the investigator's public wallet - a technique known as a 'dust attack'.
John Daghita (Lick) was arrested yesterday in the Caribbean as a direct result of my investigation, he declared ZachXBT
Similarly, the analysis platform Bubblemaps unveiled another bizarre backstory: just two days after the heist, Daghita allegedly created a meme coin called LICK on the Pump.fun platform (Solana network). The data show that the man controlled 40 per cent of the token supply, whose market value exceeded $1 million at a peak.
A system vulnerability
The case raised serious questions about the security of the US government's cryptographic safekeeping systems. CMDSS, soon after the first revelations, deactivated its website and all social profiles, disappearing from the radar as the feds combed through their databases.
It remains to be seen how much sensitive material Daghita managed to view or remove before his arrest. The incident exposes a structural fragility: even the most protected government infrastructures can capitulate in the face of an insider threat, especially when it comes to digital assets where a private key represents the only bulwark between security and outright theft.
