FBI Arrests Crypto Thief Who Allegedly Stole $46 Million from Government Wallets

The FBI has arrested John Daghita, the lead suspect in a major cryptocurrency theft case tied to the U.S. government, where the perpetrator allegedly siphoned $46 million worth of cryptocurrency from state-owned wallets into his own accounts. The accused was taken into custody with the help of local French authorities in Saint Martin, an island in the northeast Caribbean, as confirmed by FBI director Kash Patel.

How the Investigation Began

The investigation leading to the arrest was initiated by a crypto analyst on X — ZachBXT — who essentially published a full exposé on Daghita in late January. Daghita had reportedly taunted ZachBXT multiple times on Telegram by sending him tiny amounts of crypto (dust attacks). Eventually, ZachBXT was able to track some of these dust attacks back to certain wallet addresses and found out they were actually managed by the government. One of these wallets held $36 million worth of crypto and was apparently tied to a $90 million seizure by the U.S. Marshals between 2024-2025. Zach reported his findings to the authorities and in just over a month, the FBI arrested the suspect.

The Family Connection

But how did John even have access to these wallet addresses? John Daghita is apparently the son of Dean Daghita, the CEO and President of Command Services & Support (CMDSS), an IT firm that was contracted by the U.S. Marshals to manage seized crypto wallets. The company's contract was even protested by another competing firm at the time of its awarding. CMDSS was hired to manage and dispose of some of the currency tied to high-profile and complex seizures in 2024.

The announcement from Kash Patel labels John Daghita himself as a government contractor, so it's unclear if he was directly involved or if he just (secretly) exploited the access his father had. Moreover, whether Daghita Sr. was even aware of his son's activities remains to be seen.

The Arrest

Although Daghita has been taken into federal custody, he has not been formally charged, much less convicted, of a crime. During the arrest, authorities reportedly found Daghita with a briefcase full of cash and multiple security keys.

This case highlights the vulnerabilities in managing digital assets, even within government agencies, and raises questions about the security protocols surrounding seized cryptocurrency. The fact that a contractor's family member could allegedly exploit privileged access to government wallets underscores the need for more robust oversight and separation of duties in handling sensitive digital assets.

The investigation's rapid progression from public exposure to arrest also demonstrates the growing sophistication of crypto investigators and the increasing traceability of blockchain transactions, even when criminals attempt to cover their tracks through seemingly innocuous methods like dust attacks.

As the case develops, it will likely prompt a review of how government agencies manage and secure seized cryptocurrency, potentially leading to new protocols and safeguards to prevent similar breaches in the future.