U.S. Marshals Service

Summary

In a notable insider theft case, a government contractor was arrested in the Caribbean by French law enforcement working with the FBI for allegedly stealing $46 million in cryptocurrency from a federal crypto stockpile managed by the U.S. Marshals Service. The suspect, identified as the son of a top executive at a firm contracted to securely store the crypto on behalf of the agency, was linked to the theft through blockchain analysis and Telegram activity, where a connected account inadvertently revealed control over a wallet address tied to the crime. The theft, which occurred in 2024, was largely mitigated when the majority of the stolen funds were returned within 24 hours, though the full extent of the loss was significant. The investigation, led in part by blockchain analyst ZachXBT, highlighted vulnerabilities in custody arrangements for government-held digital assets and the growing risk of insider involvement in large-scale crypto thefts.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In 2024, approximately $46 million worth of cryptocurrency was stolen from the U.S. Marshals Service (USMS), a federal agency responsible for, among other duties, managing and safeguarding assets seized by law enforcement. The theft involved crypto holdings under the custody of the USMS and was later linked through blockchain analysis to John Daghita, who was described as a government contractor and the son of a top executive at a firm that had been granted a contract to securely store cryptocurrency on behalf of the USMS. The nature of the incident pointed toward an inside job, with the alleged perpetrator having direct or familial ties to the contracted entity responsible for safeguarding the seized digital assets. According to reports, the vast majority of the stolen funds were returned within 24 hours of the theft, suggesting rapid internal or technical response mechanisms were triggered once the loss was identified. At the time the incident was first investigated, the USMS declined to comment publicly, citing the ongoing nature of the investigation.

The investigation into the theft gained significant traction in January when blockchain analyst and Paradigm advisor ZachXBT publicly connected Daghita to the crime. According to the account, a Telegram account associated with Daghita disclosed control over a blockchain address tied to the stolen USMS funds. The disclosure occurred during a public dispute in a Telegram group chat in which Daghita and another user were arguing over which of them controlled a larger amount of cryptocurrency. ZachXBT subsequently went public with his investigative findings, tracing the on-chain activity back to Daghita. The USMS itself did not issue a public statement regarding the investigation, and the agency declined to provide comment to media outlets when approached about the matter. Following the publication of ZachXBT's findings, the case was referred for further action by federal law enforcement authorities.

The culmination of the investigation came on March 5, 2026, when FBI Director Kash Patel announced the arrest of John Daghita. The arrest was carried out by French law enforcement on the island of Saint Martin in collaboration with the FBI, underscoring the international cooperation required to apprehend the suspect who had reportedly fled the United States. Patel described Daghita as a government contractor in a public statement on X, and emphasized the FBI's commitment to pursuing individuals who defraud American taxpayers, regardless of their location. In his statement, Patel said the FBI would "continue working 24/7 with our international partners to track down, apprehend, and bring to justice those who attempt to defraud American taxpayers—no matter where they try to hide." Following the arrest, ZachXBT publicly commented on the outcome via X, writing, "John Daghita (Lick) was arrested in the Caribbean yesterday as a direct result of my investigation . . . Thanks for the last laugh, John." The arrest represented a direct outcome of the blockchain-based investigative work conducted by ZachXBT in coordination with law enforcement.

The incident occurred against a broader backdrop of increasing cryptocurrency-related crime and the growing role of digital assets within federal holdings. The U.S. government is the largest known holder of bitcoin among nation-states, largely as a result of years of seizures conducted by federal law enforcement. Historically, these assets were periodically sold off, but the establishment of a strategic Bitcoin Reserve via executive order by President Trump the previous year ended that practice, leaving the government to retain its seized holdings. Patrick Witt, Executive Director of the President's Council of Advisors for Digital Assets, indicated as recently as January that the bitcoin reserve remained a priority for the White House, even though no new purchases had been made on behalf of the reserve or related crypto stockpiles. Several states, including Arizona and Texas, have also established their own state-level crypto reserves. Meanwhile, illicit use of cryptocurrency reached record levels in 2025, with blockchain analytics firm Chainalysis estimating $154 billion worth of transfers tied to criminal activity during that year. The theft from the USMS fit within a broader pattern of inside jobs and security failures that have plagued large crypto holdings, highlighting the ongoing vulnerabilities associated with safeguarding significant digital asset reserves.

Sources

Sources available to members: 1 source.