A leaked group chat recording captured a menace actor named “John” screensharing pockets balances and shifting hundreds of thousands in crypto, based on findings shared by ZachXBT.
The outstanding on-chain investigator stated John, often known as “Lick,” was caught displaying off roughly $23 million in crypto throughout a heated argument with one other menace actor in a chat group.
“Band for Band” Gone Incorrect
The dispute reportedly was what cybercrime circles name a “band for band,” the place folks attempt to show who has more cash by displaying pockets balances and shifting funds in actual time. ZachXBT stated the recording reveals John controlling a number of wallets and shifting giant quantities of crypto whereas the interplay was being captured.
After reviewing the footage, the investigator stated he traced the funds and linked the wallets proven within the recording to greater than $90 million in suspected thefts.
ZachXBT stated he then traced the funds backward and reported that one of many wallets within the chain acquired 1,066 WETH on November 20, 2025. He additional claimed the funds could possibly be traced again to a pockets that acquired $24.9 million from a US authorities handle in March 2024, which he stated was linked to the Bitfinex hack seizure, a theft from the US authorities that he had beforehand reported in October 2024.
He additionally stated the pockets proven within the recording was tied to over $63 million in inflows from suspected victims and authorities seizure addresses in This fall 2025, itemizing a number of giant incoming transfers in November and December 2025. The on-chain sleuth added that one other 4.17K ETH value about $12.4 million was acquired from MEXC and flowed into the identical pockets.
USMS Crypto Asset Contract and a Household Tie
ZachXBT stated that John had an intensive historical past of boasting about his web value on Telegram and shared the account identifier tied to these messages. He additionally pointed to rumors circulating in cybercrime Telegram channels, which revealed John could possibly be John Daghitia, who was beforehand arrested in September 2025, however acknowledged that extra analysis could be wanted to completely verify the identification.
Moreover, the investigator raised questions on how John could have gained entry within the first place, whereas stating that John’s father owns CMDSS, an organization with an lively authorities IT contract in Virginia. ZachXBT stated the agency was awarded a contract to help the US Marshals Service in managing and disposing of seized and forfeited crypto property, however added that it stays unclear how John could have obtained entry by his father.
After ZachXBT revealed the thread, he stated John shortly modified particulars on his Telegram profile, together with eradicating NFT-related usernames and updating his display title. ZachXBT additionally reported that his personal public ENS handle was later “dusted” from one of many wallets linked to the suspected thefts.
The submit A Pockets Flex Turned Into an On-Chain Path: ZachXBT Hyperlinks ‘Lick’ to US Seizure-Associated Funds appeared first on CryptoPotato.