FBI Director Kash Patel has suggested that the search for crypto-crime suspects is far from over. This comes after the apprehension of a 25-year-old individual, John Daghita, who has been accused of stealing more than $46 million in digital assets from the US Marshals Service’s wallets. The operation was a joint effort by the French law enforcement agency, the Gendarmerie Nationale, and the FBI, resulting in the apprehension of Daghita, also known as “Lick,” on the island of Saint Martin in the Caribbean on March 4, 2026. It is also important to note that the accused’s father was a contractor for the US Marshals Service.
In a post shared on X, Patel wrote,
Investigators said the arrest followed a months-long probe that began after an on-chain analyst traced large amounts of stolen ether to wallets linked to a company run by Daghita’s father that managed cryptocurrency holdings for the US Marshals Service.
Read FBI Director Kash Patel’s full message on John Daghita’s arrest
In his X post, Patel wrote,
How a Telegram dispute helped FBI to track down John Daghita
According to a Forbes piece, the investigation began in January 2026 after a dispute arose between John Daghita and another alleged cybercrime perpetrator in a private Telegram group. The dispute led Daghita to display his crypto wallets on screen and flip large sums of money between them on camera to show what he owned.
A pseudonymous on-chain investigator, known as ZachXBT, analysed the recording and traced wallet activity. By following the transactions, he linked the funds to cryptocurrency previously seized by the US government. ZachXBT said he alerted US law enforcement before publishing his findings, and the case became public on January 23.
Investigators also looked at a possible connection through Daghita’s father, Dean Daghita. He is president of Command Services & Support, a Virginia technology company that received a contract in October 2024 to help the US Marshals Service manage and dispose of seized digital assets. It remains unclear how John Daghita gained access to the wallets, or whether the access was obtained through his father’s company.
After ZachXBT published the investigation, Daghita reportedly continued to respond on Telegram and sent small amounts of the allegedly stolen funds to the investigator’s public wallet address, a tactic sometimes used to taunt or implicate others.
Authorities later arrested Daghita in Saint Martin. According to the FBI, he was carrying a briefcase containing cash, along with several hard drives and hardware security keys at the time of his arrest.
