Key Takeaways
- A contractor’s son allegedly stole more than $40 million from U.S. government–seized crypto wallets, according to blockchain investigator ZachXBT.
- The theft appears tied to insider access at a firm hired by the U.S. Marshals Service to manage seized digital assets.
- The case raises serious questions about how securely the U.S. government stores billions of dollars worth of confiscated Bitcoin.
For years, the U.S. government has quietly become one of the world’s largest holders of Bitcoin. It has amassed billions of dollars’ worth of seized crypto from cases like Silk Road and the Bitfinex hack.
That strategy now faces uncomfortable scrutiny after allegations surfaced that millions of dollars were siphoned from government coffers—not by hackers, but by insiders within the custody system itself.
According to blockchain investigator ZachXBT , the son of a contractor working with the U.S. Marshals Service (USMS) allegedly stole more than $40 million in digital assets from wallets holding seized government crypto.
The revelations have sent shockwaves through both the crypto industry and law enforcement circles. It has exposed what may be deep vulnerabilities in how the U.S. safeguards its digital holdings.
Bitget
Bitunix
BTCC
How the Alleged Theft Unfolded
The allegations center on Command Services & Support (CMDSS), a Virginia-based IT firm led by Dean Daghita.
In October 2024, CMDSS was awarded a U.S. Marshals Service contract to manage and dispose of certain categories of seized cryptocurrencies—assets deemed too complex for handling by major exchanges.
That contract placed CMDSS in charge of highly sensitive wallets tied to major criminal cases, including Bitcoin seized from the infamous 2016 Bitfinex hack.
ZachXBT’s investigation began after a leaked recording from a private Telegram dispute surfaced online.
In the video, a user identified as “John,” allegedly John Daghita, screen-shared an Exodus wallet showing millions of dollars in crypto holdings.
During the recording, he appeared to move funds in real time, consolidating large amounts of Ether and Tron-based tokens into a single wallet.
On-chain analysis linked those assets back to wallets known to hold government-seized crypto.
One transaction trail pointed directly to a government address that received roughly $24.9 million in Bitcoin tied to Bitfinex-related seizures earlier in 2024.
Insider Access and a Narrow Escape
Further blockchain data suggests that in October 2024, around $20 million was drained from USMS-controlled wallets.
Most of the funds were returned within 24 hours, but roughly $700,000 routed through instant exchanges disappeared permanently.
ZachXBT believes the theft was only possible because of insider access linked to CMDSS’s role as a custodian.
In a twist of irony, the exposure may have come from overconfidence.
Investigators say John was effectively “rage-baited” into showing wallet activity during the Telegram argument, providing crucial evidence tying him to the funds.
Unconfirmed reports circulating in cybercrime circles suggest John may have been arrested in September 2025, though no public charges have been announced.
Neither the U.S. Marshals Service nor CMDSS has issued an official statement.
Bigger Than $40 Million?
ZachXBT estimates that the alleged thefts could exceed $90 million when accounting for additional suspicious wallet activity between November and December 2025.
Some of those funds remain untouched. One compromised wallet still holds approximately $18.5 million, raising fears that more assets could be drained.
The incident has renewed criticism of how the U.S. government manages seized crypto.
Previous reports revealed that the USMS has relied on spreadsheets to track holdings and has struggled to provide precise estimates of total crypto under custody.
Competitor firms had already challenged CMDSS’s contract award in 2024, citing licensing concerns and potential conflicts of interest.
Why This Matters for U.S. Bitcoin Holdings
The U.S. government controls billions of dollars in seized Bitcoin, much of it destined for future auctions or long-term custody.
This case highlights how insider threats—not just external hackers—pose a serious risk to those assets.
Experts warn that without stronger safeguards such as multi-signature wallets, independent audits, and continuous blockchain monitoring, similar incidents could happen again.
The alleged theft echoes earlier insider-driven crypto crimes, including a 2023 Silk Road–related Bitcoin theft that shocked law enforcement.
With Bitcoin trading near $90,000 in early 2026, even small security lapses can translate into enormous losses.
More broadly, the episode threatens confidence in the government’s ability to manage digital assets responsibly—an issue that could ripple through future seizures, auctions, and policy decisions.
For now, the scandal leaves an uncomfortable question hanging over Washington: if this much slipped through once, how secure is the rest of the government’s Bitcoin?
