ZachXBT Exposes John (Lick): Over $90 Million in Crypto Thefts Linked, Including U.S. Government Seizure Funds
Crypto investigator ZachXBT just dropped another bombshell—tying an individual known as 'John (Lick)' to a sprawling trail of digital asset thefts.
The $90 Million Paper Trail
The alleged scheme involves more than $90 million in pilfered funds. The most striking detail? Part of that haul appears connected to assets previously seized by U.S. government authorities. It’s a twist that adds a layer of bureaucratic irony to the heist.
Active Pursuit in a Trustless World
The report underscores the relentless, crowd-sourced scrutiny defining crypto’s modern era. While anonymous, these investigators follow the immutable money trail blockchain technology provides—turning transparency into a potent weapon against bad actors.
Finance’s New Reality Check
For all the talk of decentralization, the incident highlights a recurring theme: where large sums of value gather, human nature follows. It’s a cynical reminder that in finance, whether digital or traditional, the incentive to ‘borrow’ from the till never really goes away—it just gets a software update.
Source: ZachXBT/X
John’s wallets show direct links to seized U.S. funds and past thefts
In the second part of the call, Dritan kept trolling him while another $6.7 million in ETH landed in a different wallet: 0xd8bc7ea538c2e9f178a18cc148892ae914a55d08. By the time the show-off ended, John had pulled together $23 million in total into that same address. He fully controlled it and the tron one too. All of that got captured in the video.
Zach didn’t stop there. He went back through the transactions. That 0xd8bc address had received crypto from another wallet: 0x8924. In the recording, John said out loud that he owned that one too. On November 20, 2025, 0x8924 received 1,066 WETH from a third wallet: 0xc7a2. The transaction ID was 0x76c6e92c4cefda209263a214241f1b47b9cff0123e9d292d613aea3447466dd0.
That 0xc7a2 wallet had previously received $24.9 million from a U.S. government wallet back in March 2024. That transaction was tied to funds the government seized in the Bitfinex hack. Zach had already flagged that same address in a post from October 2024. Today, $18.5 million still sits in 0xc7A253fD3C61CF69d043e6184c107dF4E29475B5.
More red flags showed up. That same 0xd8bc wallet is linked to $63 million from sketchy wallets during Q4 2025. Here’s the breakdown, according to Zach:
- $13.5 million from 0x77a722bf33787c3512d0f4fc36412140057f4223
- $15.4 million from 0xf51b044f998277b17467cd713d72b403e16fad48
- $3 million from TACZPnbg2Fi2ppC3cGxQxZb95SqwAZVAw9
- $1 million from 6tMdWb3w3UaVq4JRSm1qa2s8mVwj2MYFAveJEL6S93Ua
Then there’s today’s activity. 4,170 ETH, worth about $12.4 million, came from MEXC into the same 0xd8bc wallet. The ETH passed through this wallet: 0xe0f7a45a491d53f9361d35b4ef9908986d3b37b7.
John clearly doesn’t hide. His Telegram account has a long history of bragging about how rich he is and calling people broke. His username is tied to TG ID 8269661864. After the post by Zach, he quickly wiped out his NFT usernames and changed his screenname, but it was too late.
“Rumors circulating from cybercrime Telegram channels indicate John could be John Daghitia who was previously arrested in Sep 2025. Though more research is needed to fully confirm,” said Zach.
To top it off, someone used one of the theft wallets to send dust to zachxbt.eth as a response to the thread. The transaction hash was 0x25d3b02b17ccf5f0867bfbaa86c4cb918766d2b79e30cdcb7847298febfa2d15.
Join a premium crypto trading community free for 30 days - normally $100/mo.
