A U.S. government contractor’s son, accused of stealing more than $46 million in cryptocurrency from the U.S. Marshals Service, was arrested Wednesday on the Caribbean island of Saint Martin.
The arrest was carried out during a joint operation between the FBI and France’s elite tactical unit, the Groupe d’Intervention de la Gendarmerie Nationale. FBI Director Kash Patel confirmed the arrest in a statement on Thursday.
According to Patel, John Daghita, a U.S. government contractor, was detained with assistance from French law enforcement units in Saint Martin and Guadeloupe following coordination with the FBI.
Authorities also seized several items during the arrest, including an undisclosed amount of U.S. currency in $100 banknotes, multiple hard drives, and security keys believed to be connected to the investigation.
Daghita reportedly used the online alias “Lick” and is the son of Dean Daghita, the president and chief executive officer of Command Services and Support. The Virginia-based company has held a contract with the U.S. Marshals Service since October 2024 to help manage and dispose of seized digital assets.
The assets handled by the company reportedly included cryptocurrency connected to the 2016 Bitfinex exchange hack, one of the largest cryptocurrency thefts in history. During that incident, attackers stole around 120,000 bitcoins from the Hong Kong-based exchange.
Blockchain investigator ZachXBT publicly exposed the case in late January 2026 after tracing $23 million in cryptocurrency movements from wallets linked to the U.S. Marshals Service to addresses he associated with Daghita.
According to the investigator, Daghita unintentionally revealed his involvement during a dispute with another threat actor known as Dritan Kapplani Jr. In a recorded private Telegram conversation, Daghita allegedly demonstrated the ability to move large amounts of cryptocurrency between wallets in real time.
Further blockchain analysis reportedly linked the wallets involved to cryptocurrency that had been seized by the U.S. government following the Bitfinex hack investigation.
After ZachXBT shared his findings with authorities, Daghita allegedly taunted the investigator by sending small amounts of the stolen cryptocurrency to his public wallet address through Telegram messages. This tactic, known as a dust attack, involves sending small transactions to a wallet as a form of harassment or tracking.
ZachXBT later commented on the arrest, saying that he had uncovered how Daghita allegedly abused access at his father’s company to steal millions in seized cryptocurrency assets from the U.S. government.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The investigation into the theft and related cryptocurrency movements is ongoing.
