John “Lick” Daghita’s sloppy story has taken an even more serious turn as ZachXBT reveals that his father allegedly owns CMDSS, a company that is currently doing work for a government agency.
According to a new tweet from onchain sleuth ZachXBT, John is not just an opportunist who happens to know how to hack and has a deep grudge against the deep state. His name is reportedly John Daghita, and he is more of a nepo-baby who may just be abusing privileges from daddy dearest.
Zach claims John’s father is Dean Daghita, the owner of CMDSS, a company that currently holds an active US government IT contract in Virginia. That contract specifically involves providing assistance to the US Marshals Service (USMS) by helping them manage and dispose of seized or forfeited crypto assets.
It all sounds mundane at first, but it all comes together nicely when one takes into account the recent scandal linked to John Lick. The contract access his father’s company enjoys is thought to have helped John obtain some insider information or even direct access, which allowed him to steal from government-controlled wallets.
According to Zach, it is still unclear how John may have gotten direct access. However, it is clear that he is linked to digital crimes that have seen millions vanish, and not just from government-controlled wallets.
For now, there have been no public arrests or DOJ confirmations, but the onchain evidence has been making rounds across the Internet. Law enforcement could eventually intervene.
John Lick Daghita’s flamboyant lifestyle outed him
Up until two days ago, John Lick had avoided detection. He had over $20 million in crypto wallets. However, things started to unravel when he got into a heated argument with another threat actor known as Dritan Kapplani Jr. in a group chat to see who had more funds in crypto wallets.
By the time the showoff session wrapped up, John had flaunted $23 million in total, moving the funds between wallets ZachXBT claims he clearly controls.
After that, Zach began tracing backwards to verify the source of funds and found that one of the wallets, the 0xc7a2 wallet, had previously received $24.9 million from a U.S. government wallet back in March 2024.
That transaction was linked to funds the government seized in the Bitfinex hack, and Zach had already flagged that same address in a post from October 2024. Another wallet was linked, the 0xd8bc wallet, which goes back to $63 million obtained from sketchy wallets during Q4 2025.
John just enjoys showing off
According to reports, it was only a matter of time before this happened, given how much John loves to show off. The Telegram account linked to him reportedly has a long history of bragging about his riches and brokeshaming people.
His username is tied to TG ID 8269661864. After he was outed by Zach, he allegedly wiped out his NFT usernames and quickly changed his screen name, but the damage was already done.
Zach later revealed that there are rumors circulating in cybercrime Telegram circles indicating John could be John Daghitia, who had previously been arrested in September 2025. He did concede that more research was needed to fully confirm it.
Since he made the link between John and his father, Zach claims the CMDSS company X account, website, & LinkedIn were all deactivated, and John Daghita (Lick) began trolling again on Telegram shortly after.
