A Wallet Flex Turned Into an On-Chain Trail: ZachXBT Links ‘Lick’ to US Seizure-Related Funds
A leaked group chat recording captured a risk actor named “John” screensharing pockets balances and shifting tens of millions in crypto, in accordance to findings shared by ZachXBT.
The distinguished on-chain investigator mentioned John, often known as “Lick,” was caught displaying off roughly $23 million in crypto throughout a heated argument with one other risk actor in a chat group.
“Band for Band” Gone Wrong
The dispute reportedly changed into what cybercrime circles name a “band for band,” the place folks attempt to show who has extra money by displaying pockets balances and shifting funds in actual time. ZachXBT mentioned the recording exhibits John controlling a number of wallets and shifting giant quantities of crypto whereas the interplay was being captured.
After reviewing the footage, the investigator said he traced the funds and linked the wallets proven within the recording to greater than $90 million in suspected thefts.
ZachXBT mentioned he then traced the funds backward and reported that one of many wallets within the chain obtained 1,066 WETH on November 20, 2025. He additional claimed the funds may very well be traced again to a pockets that obtained $24.9 million from a US authorities deal with in March 2024, which he said was connected to the Bitfinex hack seizure, a theft from the US authorities that he had beforehand reported in October 2024.
He additionally mentioned the pockets proven within the recording was tied to over $63 million in inflows from suspected victims and authorities seizure addresses in This autumn 2025, itemizing a number of giant incoming transfers in November and December 2025. The on-chain sleuth added that one other 4.17K ETH value about $12.4 million was obtained from MEXC and flowed into the identical pockets.
USMS Crypto Asset Contract and a Family Tie
ZachXBT mentioned that John had an intensive historical past of boasting about his web value on Telegram and shared the account identifier tied to these messages. He additionally pointed to rumors circulating in cybercrime Telegram channels, which revealed John may very well be John Daghitia, who was beforehand arrested in September 2025, however acknowledged that extra analysis can be wanted to absolutely verify the identification.
Additionally, the investigator raised questions on how John could have gained entry within the first place, whereas stating that John’s father owns CMDSS, an organization with an energetic authorities IT contract in Virginia. ZachXBT mentioned the agency was awarded a contract to help the US Marshals Service in managing and disposing of seized and forfeited crypto property, however added that it stays unclear how John could have obtained entry by way of his father.
After ZachXBT printed the thread, he mentioned John shortly modified particulars on his Telegram profile, together with eradicating NFT-related usernames and updating his display screen identify. ZachXBT additionally reported that his personal public ENS deal with was later “dusted” from one of many wallets linked to the suspected thefts.
The submit A Wallet Flex Turned Into an On-Chain Trail: ZachXBT Links ‘Lick’ to US Seizure-Related Funds appeared first on CryptoPotato.
