Blockchain investigator ZachXBT reported that John Daghita, also known online as “Lick,” was arrested in the Caribbean on March 4, 2026, following an investigation into the alleged theft of more than $46 million in seized cryptocurrency assets.
According to statements shared by ZachXBT on social media, the investigation began in late January 2026 and focused on funds connected to wallets associated with seized digital assets managed through systems linked to the United States Marshals Service (USMS).
Investigation Findings
ZachXBT stated that the investigation uncovered evidence suggesting that Daghita had misused internal access to systems operated by CMDSS, a company reportedly holding a contract with the U.S. Marshals Service related to the management of seized cryptocurrency assets.
CMDSS is said to be associated with Daghita’s father, and the alleged misuse of internal access allowed the suspect to move digital assets from government-controlled wallets. The investigator claimed that the total amount taken exceeded $46 million, based on blockchain transaction analysis conducted during the investigation.
On-Chain Activity and Public Wallet Interaction
Following the initial exposure of the alleged theft, ZachXBT reported that Daghita responded publicly through a Telegram channel, where he posted messages directed at the investigator.
The suspect also allegedly conducted a “dust attack” on the investigator’s public wallet address. Dust attacks involve sending small amounts of cryptocurrency to a target wallet, sometimes as a means of harassment or to attempt to track wallet activity. According to the investigator, the funds used in the dust transactions were linked to the stolen assets identified during the investigation.
Arrest in the Caribbean
ZachXBT stated that Daghita was arrested in the Caribbean on March 4, 2026, describing the arrest as a direct result of the investigation and subsequent exposure of the alleged theft. As of the time of reporting, official confirmation from law enforcement authorities has not yet been publicly detailed, and further information about the charges or the specific jurisdiction involved in the arrest has not been released.
Ongoing Developments
The case highlights the growing role of independent blockchain investigators in tracing illicit crypto transactions through publicly available blockchain data.
Additional details regarding the arrest, possible charges, and the recovery status of the allegedly stolen cryptocurrency assets may emerge as the investigation continues. ZachXBT concluded his statement by addressing the suspect directly, saying, “Thanks for the last laugh, John,” following the reported arrest, in a previous investigation, he detailed an alleged insider trading scheme involving staff at Axiom Exchange.
