A leaked group chat recording captured a risk actor named “John” screensharing pockets balances and shifting hundreds of thousands in crypto, based on findings shared by ZachXBT.
The outstanding on-chain investigator stated John, also called “Lick,” was caught exhibiting off roughly $23 million in crypto throughout a heated argument with one other risk actor in a chat group.
“Band for Band” Gone Flawed
The dispute reportedly was what cybercrime circles name a “band for band,” the place folks attempt to show who has extra money by exhibiting pockets balances and shifting funds in actual time. ZachXBT stated the recording exhibits John controlling a number of wallets and shifting massive quantities of crypto whereas the interplay was being captured.
After reviewing the footage, the investigator stated he traced the funds and linked the wallets proven within the recording to greater than $90 million in suspected thefts.
ZachXBT stated he then traced the funds backward and reported that one of many wallets within the chain acquired 1,066 WETH on November 20, 2025. He additional claimed the funds may very well be traced again to a pockets that acquired $24.9 million from a US authorities deal with in March 2024, which he stated was related to the Bitfinex hack seizure, a theft from the US authorities that he had beforehand reported in October 2024.
He additionally stated the pockets proven within the recording was tied to over $63 million in inflows from suspected victims and authorities seizure addresses in This autumn 2025, itemizing a number of massive incoming transfers in November and December 2025. The on-chain sleuth added that one other 4.17K ETH price about $12.4 million was acquired from MEXC and flowed into the identical pockets.
USMS Crypto Asset Contract and a Household Tie
ZachXBT stated that John had an intensive historical past of boasting about his web price on Telegram and shared the account identifier tied to these messages. He additionally pointed to rumors circulating in cybercrime Telegram channels, which revealed John may very well be John Daghitia, who was beforehand arrested in September 2025, however acknowledged that extra analysis can be wanted to completely affirm the id.
Moreover, the investigator raised questions on how John could have gained entry within the first place, whereas stating that John’s father owns CMDSS, an organization with an energetic authorities IT contract in Virginia. ZachXBT stated the agency was awarded a contract to help the US Marshals Service in managing and disposing of seized and forfeited crypto property, however added that it stays unclear how John could have obtained entry by means of his father.
After ZachXBT revealed the thread, he stated John rapidly modified particulars on his Telegram profile, together with eradicating NFT-related usernames and updating his display screen identify. ZachXBT additionally reported that his personal public ENS deal with was later “dusted” from one of many wallets linked to the suspected thefts.
The publish A Pockets Flex Turned Into an On-Chain Path: ZachXBT Hyperlinks ‘Lick’ to US Seizure-Associated Funds appeared first on CryptoPotato.