The son of the owner of the contracting company for storing confiscated cryptocurrency is involved in the $40 million theft from U.S. authorities. He exposed himself during a dispute over who has more money.
Crypto detective ZachXBT revealed that John Dagita, the son of the head of the company contracted to store confiscated coins, is behind the theft of $40 million in cryptocurrency from wallets controlled by U.S. authorities.
Dagita was identified after he entered into a public dispute with another hacker about who had more cryptocurrency. In one of the Telegram chats, he posted a video in which he transfers $23 million between his wallets.
ZachXBT checked the addresses of wallets featured in the video and found that they are linked to thefts of over $90 million, of which about $40 million was stolen from confiscated crypto assets of the U.S. government. The remaining assets, according to the analyst, were presumably stolen from private individuals between November and December 2025.
"John has a complete failure with digital hygiene," commented ZachXBT. In social media photos published by the detective, Dagita poses in luxury cars with bundles of cash.
According to ZachXBT, Dagita is the son of the owner of Command Services & Support (CMDSS). In 2024, he received a contract from the U.S. Marshals Service to manage confiscated crypto assets. After the investigation was published, the website, social media, and the CMDSS LinkedIn page became unavailable.