John Daghita, son of Dean Daghita, the president of Command Services & Support (CMDSS), was arrested on Saint Martin in a coordinated international crackdown after allegedly misappropriating $46 million in crypto from the US Marshals Service (USMS), FBI Director Kash Patel wrote on X on Thursday.

Last night, John Daghita – a U.S. government contractor who allegedly stole more than $46 million in cryptocurrency from the U.S Marshals Service – was arrested on the island of Saint Martin by the French Gendarmerie’s premier elite tactical unit in a joint operation with the… pic.twitter.com/3ttochgbjk

— FBI Director Kash Patel (@FBIDirectorKash) March 5, 2026

John has been speculated to be the threat actor, who ZachXBT previously said controlled several crypto wallets tied to tens of millions of dollars in suspected stolen funds.

In posts published in January, ZachXBT said one address tied to the individual recorded more than $63 million in inflows in late 2025, and funds were traced back to wallets associated with a US government seizure connected to the Bitfinex hack.

1/ Meet the threat actor John (Lick), who was caught flexing $23M in a wallet address directly tied to $90M+ in suspected thefts from the US Government in 2024 and multiple other unidentified victims from Nov 2025 to Dec 2025. pic.twitter.com/SBAFU5hTnE

— ZachXBT (@zachxbt) January 23, 2026

After ZachXBT’s report surfaced, authorities told CoinDesk that they had opened an investigation into claims that John Daghita diverted crypto assets seized by law enforcement from government-controlled wallets.

Officials are looking into whether he obtained unauthorized access to the funds, possibly through links to his father’s company.

The inquiry is being handled by USMS, which manages seized assets in criminal cases.