A leaked group chat recording captured a threat actor named \u201cJohn\u201d screensharing wallet balances and moving millions in crypto, according to findings shared by ZachXBT.<\/p>\n
The prominent on-chain investigator said John, also known as \u201cLick,\u201d was caught showing off approximately $23 million in crypto during a heated argument with another threat actor in a chat group.<\/p>\n
The dispute reportedly turned into what cybercrime circles call a \u201cband for band,\u201d where people try to prove who has more money by showing wallet balances and moving funds in real time. ZachXBT said the recording shows John controlling multiple wallets and moving large amounts of crypto while the interaction was being captured.<\/p>\n
After reviewing the footage, the investigator said<\/a> he traced the funds and linked the wallets shown in the recording to more than $90 million in suspected thefts.<\/p>\n ZachXBT said he then traced the funds backward and reported that one of the wallets in the chain received 1,066 WETH on November 20, 2025. He further claimed the funds could be traced back to a wallet that received $24.9 million from a US government address in March 2024,\u00a0which he said was connected<\/a> to the Bitfinex hack seizure,\u00a0<\/span>a theft from the US government that he had previously reported in October 2024.<\/p>\n He also said the wallet shown in the recording was tied to over $63 million in inflows from suspected victims and government seizure addresses in Q4 2025, listing several large incoming transfers in November and December 2025. The on-chain sleuth added that another 4.17K ETH worth about $12.4 million was received from MEXC and flowed into the same wallet.<\/p>\n ZachXBT said that John had an extensive history of boasting about his net worth on Telegram and shared the account identifier tied to those messages. He also pointed to rumors circulating in cybercrime Telegram channels, which revealed John could be John Daghitia, who was previously arrested in September 2025, but acknowledged that more research would be needed to fully confirm the identity.<\/p>\n Additionally, the investigator raised questions about how John may have gained access in the first place, while stating that John\u2019s father owns CMDSS, a company with an active government IT contract in Virginia. ZachXBT said the firm was awarded a contract to assist the US Marshals Service in managing and disposing of seized and forfeited crypto assets, but added that it remains unclear how John may have obtained access through his father.<\/p>\n After ZachXBT published the thread, he said John quickly changed details on his Telegram profile, including removing NFT-related usernames and updating his screen name. ZachXBT also reported that his own public ENS address was later \u201cdusted\u201d from one of the wallets linked to the suspected thefts.<\/p>\n The post A Wallet Flex Turned Into an On-Chain Trail: ZachXBT Links \u2018Lick\u2019 to US Seizure-Related Funds<\/a> appeared first on CryptoPotato<\/a>.<\/p>","protected":false},"excerpt":{"rendered":" A leaked group chat recording captured a threat actor named \u201cJohn\u201d screensharing wallet balances and moving millions in crypto, according to findings shared by ZachXBT. The prominent on-chain investigator said John, also known as \u201cLick,\u201d was caught showing off approximately $23 million in crypto during a heated argument with another threat actor in a chat […]<\/p>\n","protected":false},"author":0,"featured_media":130109,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-130108","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-discovery"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/130108"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=130108"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/130108\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/media\/130109"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=130108"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=130108"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=130108"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}USMS Crypto Asset Contract and a Family Tie<\/h2>\n