A U.S. government contractor has been arrested in connection with the alleged theft of 6 million in cryptocurrency from the U.S. Marshals Service. The arrest, carried out in Saint Martin, marks a major breakthrough in a high-profile investigation into the security of government-held digital assets.
Arrest of John Daghita in High-Stakes Crypto Theft
Federal Bureau of Investigation Director Kash Patel confirmed that John Daghita, a U.S. government contractor, was apprehended on March 4, 2026, on the Caribbean island of Saint Martin. The arrest was executed by the French Gendarmerie’s International Cooperation Team Serious Crime Unit in Saint Martin, alongside the Groupe d’intervention de la Gendarmerie nationale of Guadeloupe, in coordination with the FBI .
Daghita is accused of stealing over 6 million in cryptocurrency from wallets managed by the U.S. Marshals Service. The funds allegedly originated from assets seized in the 2016 Bitfinex hack and were entrusted to the Marshals Service for safekeeping .
How the Theft Was Uncovered
Blockchain investigator ZachXBT first raised alarms in January 2026, linking Daghita—known online as “Lick”—to suspicious transactions involving wallets tied to U.S. government-seized cryptocurrency. The funds were traced through a series of intermediary wallets and exchanges, revealing a complex laundering operation .
ZachXBT also noted that Daghita had taunted him via Telegram and conducted “dust attacks”—small cryptocurrency transfers—to his public address, further drawing attention to the illicit activity .
Significance of the Case
This case exposes critical vulnerabilities in the management of seized digital assets by government agencies. The U.S. Marshals Service oversees billions in confiscated cryptocurrency, often relying on third-party contractors for technical support. The breach underscores the need for stronger oversight, access controls, and transaction monitoring .
According to ZachXBT, the suspect’s family connection to a contractor firm—Command Services & Support (CMDSS), which held a 2024 contract with the U.S. Marshals Service—raises concerns about potential conflicts of interest and insider threats .
Impact on Stakeholders
- U.S. Marshals Service: The breach undermines public trust in the agency’s ability to safeguard seized digital assets. It may prompt internal reviews and reforms in asset management procedures.
- Department of Justice: DOJ officials are likely to reassess contracting policies and oversight mechanisms to prevent similar incidents.
- Government Contractors: The case highlights the risks of insufficient vetting and monitoring of individuals with access to sensitive digital infrastructure.
- Blockchain Community: The investigation demonstrates the power of on-chain analysis in uncovering illicit crypto activity, reinforcing the role of independent researchers in aiding law enforcement.
Expert Perspective
According to blockchain analyst ZachXBT, “Funds moved from victim and seizure-linked addresses into intermediary theft wallets, where value was split, recombined, and cycled through multiple hops,” illustrating the sophisticated laundering methods used .
An official statement from FBI Director Kash Patel emphasized the agency’s commitment: “FBI will continue working 24/7 with our international partners to track down, apprehend, and bring to justice those who attempt to defraud American taxpayers—no matter where they try to hide” .
Broader Implications and Future Outlook
The arrest of John Daghita may serve as a catalyst for sweeping reforms in how government agencies handle digital assets. Potential developments include:
- Enhanced vetting and background checks for contractors with access to sensitive systems.
- Implementation of real-time transaction monitoring and anomaly detection for government crypto wallets.
- Stricter conflict-of-interest policies to prevent familial or personal ties from compromising security.
- Increased collaboration between law enforcement, blockchain analysts, and international partners to detect and deter crypto-related crimes.
While the arrest is a significant milestone, the full scope of the theft—such as whether additional individuals were involved or if more funds remain unaccounted for—remains under investigation.
Conclusion
The FBI’s arrest of John Daghita in Saint Martin marks a pivotal moment in the fight against crypto-enabled government fraud. The alleged theft of 6 million from the U.S. Marshals Service exposes critical weaknesses in asset management and contractor oversight. As the investigation unfolds, it is likely to spur reforms across federal agencies and highlight the essential role of blockchain forensics in safeguarding public resources.
Frequently Asked Questions
What exactly is John Daghita accused of?
John Daghita, a U.S. government contractor, is accused of stealing more than 6 million in cryptocurrency from wallets managed by the U.S. Marshals Service, allegedly tied to assets seized in the 2016 Bitfinex hack .
How was the theft discovered?
Blockchain investigator ZachXBT traced suspicious transactions from government-linked wallets to Daghita, who used the alias “Lick.” His analysis revealed complex laundering patterns and taunting behavior via Telegram .
Where and when was Daghita arrested?
Daghita was arrested on March 4, 2026, in Saint Martin by the French Gendarmerie’s elite units in coordination with the FBI .
What does this case mean for the U.S. Marshals Service?
The case highlights serious security gaps in how the U.S. Marshals Service manages seized cryptocurrency, particularly regarding contractor oversight and transaction monitoring .
Will this lead to policy changes?
Yes. The Department of Justice and other federal agencies are expected to review and strengthen protocols around contractor access, conflict-of-interest policies, and real-time monitoring of digital assets.
How can blockchain analysis help prevent future thefts?
Blockchain forensics, as demonstrated by ZachXBT’s work, can trace illicit transfers, identify laundering patterns, and support law enforcement in real-time detection of suspicious activity.
