A Wallet Flex Turned into an On-Chain Trail: ZachXBT Links ‘lick’ to US Seizure-Related Funds

ZachXBT claims that John “Lick” flaunted wallets linked to more than $90 million in suspected thefts, including seized US government funds.

A leaked recording of a group chat has captured a threat actor named “John” sharing wallet balances and moving millions in crypto, according to findings shared by ZachXBT.

The prominent on-chain researcher said John, aka “Lick,” was caught flaunting about $23 million worth of crypto during a heated argument with another threat actor in a chat group.

“Band by band” went wrong

The dispute has reportedly turned into what cybercrime circles call a “tie for tie,” with people trying to prove who has more money by showing wallet balances and moving money in real time. ZachXBT said the recording shows John managing multiple wallets and moving large amounts of crypto while the interaction was captured.

After viewing the images, the researcher said he traced the money and linked the wallets shown in the recording to more than $90 million in suspected thefts.

ZachXBT said he then traced the funds backwards and reported that one of the wallets in the chain received 1,066 WETH on November 20, 2025. He further claimed that the money was traced to a wallet that received $24.9 million from a US government address in March 2024. which he said was related to the Bitfinex hack attack, a theft from the US government that he had previously reported in October 2024.

He also said that the wallet shown in the recording was linked to more than $63 million in inflows from suspected victims and addresses of government seizures in the fourth quarter of 2025, listing several large incoming transfers in November and December 2025. The on-chain sleuth added that another 4.17K ETH worth approximately $12.4 million was received from MEXC and ended up in the same wallet.

USMS Crypto Asset contract and a family connection

ZachXBT said John had an extensive history of bragging about his net worth on Telegram and shared the account ID associated with those posts. He also pointed to rumors circulating in cybercrime Telegram channels, which suggested that John could be John Daghitia, who was previously arrested in September 2025, but acknowledged that more investigation would be needed to fully confirm the identity.

You might also like:

Additionally, the investigator raised questions about how John could have gained access in the first place, stating that John’s father owns CMDSS, a company with an active government IT contract in Virginia. ZachXBT said the company has been contracted to help the US Marshals Service manage and dispose of seized and forfeited crypto assets, but added that it remains unclear how John gained access through his father.

After ZachXBT published the thread, he said John quickly changed the details of his Telegram profile, including removing NFT-related usernames and updating his screen name. ZachXBT also reported that his own public ENS address was later “dusted” from one of the wallets linked to the suspected thefts.