ZachXBT claims John “Lick” flaunted wallets tied to greater than $90 million suspected thefts, together with US authorities seizure-linked funds.
A leaked group chat recording captured a menace actor named “John” screensharing pockets balances and transferring hundreds of thousands in crypto, in accordance with findings shared by ZachXBT.
The distinguished on-chain investigator mentioned John, also referred to as “Lick,” was caught exhibiting off roughly $23 million in crypto throughout a heated argument with one other menace actor in a chat group.
“Band for Band” Gone Improper
The dispute reportedly became what cybercrime circles name a “band for band,” the place individuals attempt to show who has extra money by exhibiting pockets balances and transferring funds in actual time. ZachXBT mentioned the recording exhibits John controlling a number of wallets and transferring massive quantities of crypto whereas the interplay was being captured.
After reviewing the footage, the investigator said he traced the funds and linked the wallets proven within the recording to greater than $90 million in suspected thefts.
ZachXBT mentioned he then traced the funds backward and reported that one of many wallets within the chain acquired 1,066 WETH on November 20, 2025. He additional claimed the funds may very well be traced again to a pockets that acquired $24.9 million from a US authorities deal with in March 2024, which he said was connected to the Bitfinex hack seizure, a theft from the US authorities that he had beforehand reported in October 2024.
He additionally mentioned the pockets proven within the recording was tied to over $63 million in inflows from suspected victims and authorities seizure addresses in This fall 2025, itemizing a number of massive incoming transfers in November and December 2025. The on-chain sleuth added that one other 4.17K ETH value about $12.4 million was acquired from MEXC and flowed into the identical pockets.
USMS Crypto Asset Contract and a Household Tie
ZachXBT mentioned that John had an intensive historical past of boasting about his internet value on Telegram and shared the account identifier tied to these messages. He additionally pointed to rumors circulating in cybercrime Telegram channels, which revealed John may very well be John Daghitia, who was beforehand arrested in September 2025, however acknowledged that extra analysis can be wanted to totally verify the id.
You may additionally like:
Moreover, the investigator raised questions on how John might have gained entry within the first place, whereas stating that John’s father owns CMDSS, an organization with an lively authorities IT contract in Virginia. ZachXBT mentioned the agency was awarded a contract to help the US Marshals Service in managing and disposing of seized and forfeited crypto property, however added that it stays unclear how John might have obtained entry by means of his father.
After ZachXBT revealed the thread, he mentioned John shortly modified particulars on his Telegram profile, together with eradicating NFT-related usernames and updating his display screen identify. ZachXBT additionally reported that his personal public ENS deal with was later “dusted” from one of many wallets linked to the suspected thefts.
SECRET PARTNERSHIP BONUS for CryptoPotato readers: Use this link to register and unlock $1,500 in unique BingX Change rewards (restricted time supply).
