On-chain probe alleges $40M government crypto theft

TLDR

An on-chain investigation alleges that over $40 million in crypto was siphoned from U.S. government seizure wallets by the son of a federal custody contractor.

1. Blockchain analyst ZachXBT links John Lick Daghita to funds traced from U.S. Marshals Service seizure wallets, with the agency now investigating the alleged insider theft.
2. The incident exposes serious weaknesses in how the U.S. government custodies seized digital assets, despite controlling an estimated hundreds of thousands of Bitcoin.
3. Key things to watch are any formal charges, contract fallout for the custodian, and whether this pushes governments toward stricter multi-sig, audits, and real-time monitoring standards.

Deep Dive

1. What Allegedly Happened

Blockchain investigator ZachXBT alleges that John Lick Daghita, son of Dean Daghita (president of contractor CMDSS), stole more than $40 million from U.S. government crypto seizure wallets managed under a U.S. Marshals Service (USMS) contract. According to reporting, on-chain traces show at least $23 million moving from wallets linked to roughly $90 million in seized assets during 20242025, after Daghita was seen in a leaked Telegram call screen-sharing an Exodus wallet and moving millions in Ether and Tron in real time.

The USMS is now investigating claims that Daghita used insider access tied to CMDSSs government contract to abuse custody of seized assets, though officials have declined detailed public comment so far and it remains unclear how keys were obtained or whether anyone else was involved. Coverage by outlets including CoinDesk describes this as an active investigation into alleged insider theft rather than a concluded criminal case yet, which keeps everything in the alleged category for now.

2. Why This Matters For Crypto Custody

CMDSS was hired to help USMS manage and dispose of seized digital assets, including complex or less liquid coins, putting contractor staff in a privileged position over government wallets. Analysts note that the case suggests weak operational controls around private keys, heavy reliance on manual processes, and limited independent oversight in federal crypto custody.

Separate coverage estimates that the U.S. government holds between roughly 198,000 and 300,000 BTC worth tens of billions of dollars, meaning any insider vulnerability is systemically significant, not just a one-off loss. Commentary in Bitcoin-focused media argues this is a custody and governance failure, not a protocol failure, and that robust multi-signature setups, strict segregation of duties, and independent audits would likely have made this type of abuse much harder.

3. What To Watch Next

Several developments will determine how impactful this becomes. First, whether U.S. authorities formally charge Daghita or others and disclose more technical detail on how access was obtained. Second, how USMS and other agencies react on the policy side, for example by tightening custody standards, rotating wallets, or re-bidding contracts.

Third, there is a broader market angle: if governments strengthen their crypto custody, that could accelerate adoption of more transparent, on-chain, multi-sig or MPC-based arrangements that large private custodians may also need to match. So far, the episode has been more about governance and national security concerns than direct price impact, with Bitcoin and Ethereum still trading mainly on macro drivers.

Conclusion

An alleged $40 million insider theft from U.S. government seizure wallets highlights that the weak point in crypto security often lies in custody operations rather than blockchains themselves. If investigations confirm the on-chain findings, the most important consequences are likely to be tighter standards for government and institutional key management, not changes to the assets themselves.