Inside the $46 Million Theft From U.S. Government Crypto Wallets and the Telegram Post That Ended It

John Daghita, 25, was arrested on the Caribbean island of Saint Martin on March 4, 2026, in a joint operation between the FBI and French Gendarmerie tactical units.

At the time of his arrest he was carrying a metal briefcase containing stacks of $100 bills, multiple hardware wallets, and several USB drives. The money allegedly came from U.S. Marshals Service seizure wallets. The investigation that found him started with a Telegram argument.

How It Happened

Daghita’s father, Dean Daghita, owns Command Services and Support, a Virginia-based technology firm holding a $4 million federal contract to manage and dispose of seized digital assets, including funds from the 2016 Bitfinex hack. The contract gave the firm access to sensitive cryptographic information tied to government-controlled seizure wallets.

John Daghita allegedly used that insider access to divert funds from USMS seizure wallets into his own accounts. The alleged theft totaled more than $46 million in cryptocurrency moved without authorization from wallets the U.S. government was holding as part of ongoing criminal cases.

The scheme ran undetected until late January 2026, when Daghita allegedly entered an argument in a Telegram group chat. To prove his wealth to an opponent he was attempting to humiliate, he screen-shared a wallet holding millions in cryptocurrency live in the chat. That screen share provided on-chain investigator ZachXBT with a live transaction trail. From that moment the investigation had a starting point it previously lacked.

What He Had When They Found Him

The metal briefcase, hardware wallets, and USB drives recovered at arrest suggest Daghita was not operating casually. Hardware wallets store private keys offline. Multiple devices suggest deliberate fragmentation of holdings across separate cold storage units, a security practice that also complicates seizure and recovery. The cash in $100 bills suggests parallel off-chain conversion of at least some of the stolen funds.

Daghita is currently held in Saint Martin and faces extradition to the United States on charges of wire fraud, money laundering, and theft of government property.

The Bigger Problem the Arrest Exposed

The individual case is dramatic. The institutional question it raises is more significant. The U.S. Marshals Service manages billions of dollars in seized cryptocurrency from criminal cases across the country. That custody relies partly on independent contractors, firms like Command Services and Support that hold federal contracts to manage sensitive cryptographic access.

If a contractor’s son could allegedly divert $46 million from seizure wallets by abusing his father’s firm’s access, the oversight and security architecture around federal digital asset custody has a documented vulnerability that predates this arrest and extends beyond it. The $46 million theft is one incident. The question of how many contractors have similar access, under what controls, and with what audit trails is a systemic question the arrest has now made unavoidable.

The post Inside the $46 Million Theft From U.S. Government Crypto Wallets and the Telegram Post That Ended It appeared first on ETHNews.