FBI Director Kash Patel has suggested that the search for crypto-crime suspects is far from over. This comes after the apprehension of a 25-year-old individual, John Daghita, who has been accused of stealing more than $46 million in digital assets from the US Marshals Service’s wallets. The operation was a joint effort by the French law enforcement agency, the Gendarmerie Nationale, and the FBI, resulting in the apprehension of Daghita, also known as “Lick,” on the island of Saint Martin in the Caribbean on March 4, 2026. It is also important to note that the accused’s father was a contractor for the US Marshals Service.In a post shared on X, Patel wrote, “FBI will continue working 24/7 with our international partners to track down, apprehend, and bring to justice those who attempt to defraud American taxpayers, no matter where they try to hide.”Investigators said the arrest followed a months-long probe that began after an on-chain analyst traced large amounts of stolen ether to wallets linked to a company run by Daghita’s father that managed cryptocurrency holdings for the US Marshals Service.
Read FBI Director Kash Patel’s full message on John Daghita’s arrest
In his X post, Patel wrote, “Last night, John Daghita – a U.S. government contractor who allegedly stole more than $46 million in cryptocurrency from the U.S Marshals Service – was arrested on the island of Saint Martin by the French Gendarmerie’s premier elite tactical unit in a joint operation with the @FBI. Thanks to the International Cooperation Team of the Serious Crime Unit of the French Gendarmerie National in Saint Martin, and to the Groupe d’intervention de la Gendarmerie nationale of Guadeloupe for the outstanding coordination. FBI will continue working 24/7 with our international partners to track down, apprehend, and bring to justice those who attempt to defraud American taxpayers—no matter where they try to hide.”
How a Telegram dispute helped FBI to track down John Daghita
According to a Forbes piece, the investigation began in January 2026 after a dispute arose between John Daghita and another alleged cybercrime perpetrator in a private Telegram group. The dispute led Daghita to display his crypto wallets on screen and flip large sums of money between them on camera to show what he owned.A pseudonymous on-chain investigator, known as ZachXBT, analysed the recording and traced wallet activity. By following the transactions, he linked the funds to cryptocurrency previously seized by the US government. ZachXBT said he alerted US law enforcement before publishing his findings, and the case became public on January 23.Investigators also looked at a possible connection through Daghita’s father, Dean Daghita. He is president of Command Services & Support, a Virginia technology company that received a contract in October 2024 to help the US Marshals Service manage and dispose of seized digital assets. It remains unclear how John Daghita gained access to the wallets, or whether the access was obtained through his father’s company.
After ZachXBT published the investigation, Daghita reportedly continued to respond on Telegram and sent small amounts of the allegedly stolen funds to the investigator’s public wallet address, a tactic sometimes used to taunt or implicate others.Authorities later arrested Daghita in Saint Martin. According to the FBI, he was carrying a briefcase containing cash, along with several hard drives and hardware security keys at the time of his arrest.
