A US-based crypto theft has been linked to the theft of nearly 1,000 BTC (approximately $90 million), according to an onchain investigation published by blockchain analyst ZachXBT on X.
The investigation alleges that the teenager gained unauthorized access to funds belonging to clients of Unchained by exploiting credentials connected to his father, who reportedly worked with a US government agency involved in seized asset management.
Luxury Spending Led to De-Anonymization
Following the theft, the suspect drew attention by publicly flaunting large crypto holdings and extravagant spending, which ultimately contributed to his identification within cybercrime circles.
ZachXBT identified the threat actor as “John” (also known as Lick), who was observed flexing over $23 million in crypto assets across wallets directly linked to more than $90 million in suspected thefts. The activity is believed to involve funds originating from US government seizure addresses and multiple unidentified victims.
Recorded Telegram Dispute Exposed Wallet Control
According to the investigation, John was exposed during a heated Telegram group chat dispute with another threat actor known as Dritan Kapplani Jr., where participants attempted to prove wallet balances in what is referred to within “The Com” cybercrime community as a band-for-band (B4B) challenge.
The entire interaction was recorded. In the first segment, John screen-shared his Exodus wallet, revealing a Tron address holding approximately $2.3 million. In a subsequent segment, while Dritan continued mocking him, an additional $6.7 million worth of ETH was transferred into the same wallet in real time.
Screenshots from the recordings were shared by ZachXBT as part of the research.
Following the B4B interaction, John consolidated roughly $23 million into the Ethereum address 0xd8bc, with recordings clearly demonstrating his control over multiple linked addresses. ZachXBT noted that additional wallets may be identifiable through further analysis of the footage.
Funds Traced to US Government Seizure Addresses
Tracing the funds backward, ZachXBT found that one of the wallets received $24.9 million in March 2024 from a US government-linked address associated with the Bitfinex hack seizure — an issue previously reported by the analyst in October 2024.
The same address is reportedly tied to over $63 million in inflows from suspected victims and government seizure wallets during Q4 2025.
Separately, another 4,170 ETH (approximately $12.4 million) was received earlier today from the crypto exchange MEXC, with the funds flowing into the same consolidation address 0xd8bc.
Prior Arrest and Ongoing Rumors
ZachXBT also highlighted John’s extensive Telegram history, where he frequently boasted about his net worth while disparaging others as “broke.”
Rumors circulating within cybercrime Telegram channels suggest the individual may be John Daghitia, who was reportedly arrested in September 2025. However, no official confirmation has been made regarding his identity at the time of publication.