Unmasking the Crypto Thief

ZachXBT’s investigation points to an individual known as “Lick,” whose real name is John Daghita. Daghita is the son of Dean Daghita, CEO of CMDSS, a firm tasked with managing seized cryptocurrencies. The investigation links John Daghita to the illicit transfer of millions in cryptocurrency from government-controlled wallets.

According to company records, Dean Daghita leads Command Services & Support (CMDSS), a firm based in Haymarket, Virginia. CMDSS was awarded a contract in October 2024 to handle “Class 2-4” cryptocurrencies, including those not supported by major exchanges.

Tracing the Stolen Funds

The investigation gained traction following a recorded dispute in a Telegram group chat, where “Lick” engaged in a “band-for-band” argument to prove crypto ownership. During this exchange, he revealed a Tron address with $2.3 million and transferred another $6.7 million in ether.

ZachXBT traced these transactions back to a government address linked to assets seized from the infamous 2016 Bitfinex hack. This address had transferred $24.9 million to another wallet, which was involved in the theft.

Scrutiny on CMDSS

CMDSS has faced previous scrutiny regarding its government contract. Wave Digital Assets, a competitor, had protested CMDSS’s contract award, citing licensing issues and potential conflicts of interest. Despite this, the Government Accountability Office upheld the contract.

Challenges in managing seized crypto persist, as highlighted by a February 2025 CoinDesk report. The U.S. Marshals Service reportedly struggles with inventory controls, relying on spreadsheets to manage their holdings.

The ongoing investigation by ZachXBT continues to unravel the intricate details of this crypto theft case, shedding light on vulnerabilities within government systems handling digital assets.

The post Crypto Theft: Shocking $40M Scandal Unveiled by Investigator appeared first on Crypto Market Insights: Dive In with CryptoUpdate.io.

In August 2024, a single victim’s account lost approximately 4,100 BTC worth $243 million in an overnight heist. The culprits were three gamers-turned-hackers, who employed sophisticated social engineering tactics to commit the theft. The youngest among them, 19-year-old Veer Chetal, became notorious for his audacious acts.

The trio, including Chetal, Malone Lam, and Jeandiel Serrano, orchestrated a well-planned attack. They deceived the victim with fake calls from Google and Gemini support teams, convinced the victim to change their 2-factor authentication (2FA), and then transferred the funds to a compromised wallet. Moreover, they tricked the victim into sharing their screen via AnyDesk, revealing their Bitcoin private key.

Despite executing their plan successfully, their sloppy mistakes led to their downfall. Crypto investigator ZachXBT, who had been following the case closely, discovered a recording of the hackers’ live reactions as they received the stolen Bitcoin. Chetal further incriminated himself by accidentally leaking his name during the livestream and purchasing luxury items with the stolen funds.

Following the investigation, all three culprits were arrested. However, Chetal’s saga didn’t end there. After agreeing to cooperate with the authorities and pleading guilty, he was involved in yet another scam while out on bail, stealing an additional $2 million.

This case serves as a stark reminder of the need for vigilance in the digital age, especially as young, tech-savvy individuals are drawn into the world of high-stakes digital crime. Awareness, open conversations, and firm boundaries around financial access are crucial to curb such illicit activities.

The post Bitcoin Heist Unmasked: Teen Hacker Steals $243M and Unwittingly Reveals Identity appeared first on Crypto Market Insights: Dive In with CryptoUpdate.io.

OFAC announced on Tuesday that it had sanctioned North Korea-based Song Kum Hyok for purportedly stealing information from US citizens to create false identities. This information was then passed on to foreign IT workers hired to seek employment in US firms. Additionally, Russian national Gayk Asatryan was sanctioned for reportedly using his companies to employ numerous North Korean IT professionals under long-term contracts initiated with North Korean trading firms in 2024.

There has been a surge in fraudulent IT personnel with connections to North Korea, officially known as the Democratic People’s Republic of Korea (DPRK), enhancing their infiltration operations. A report by Google in April highlighted that the infrastructure for these schemes has spread globally.

“The Treasury will continue to utilize all available resources to disrupt the Kim regime’s attempts to evade sanctions through digital asset theft, the impersonation of Americans, and malicious cyber-attacks,” stated Treasury Deputy Secretary Michael Faulkender.

OFAC revealed that North Korea aims to generate revenue for its ballistic missile programs by deploying a legion of highly skilled IT workers worldwide, primarily in China and Russia. The workforce primarily targets employers in wealthier nations and utilizes a variety of mainstream and industry-specific networking platforms.

The sanctions result in the freezing of all US assets linked to Asatryan, Song, and the four sanctioned Russian entities. US citizens are now prohibited from conducting financial transactions or business dealings with these parties, under the threat of civil and criminal penalties.

North Korea, infamous for high-profile hacks such as the $1.5 billion Bybit exploit, appears to be shifting tactics according to blockchain intelligence firm TRM Labs. “DPRK-linked operations are increasingly shifting towards deception-based revenue generation, including IT worker infiltration,” the firm commented.

TRM Labs estimates that actors aligned with North Korea are responsible for $1.6 billion of the $2.1 billion stolen across 75 crypto hacks and exploits in the first half of 2025.

US authorities have been intensifying their crackdown on fraudulent North Korean IT worker schemes this year. On June 30, four North Korean nationals were charged with wire fraud and money laundering after posing as remote workers at US and Serbian blockchain firms. The US Department of Justice also announced on June 5 that it was attempting to seize $7.74 million in frozen crypto allegedly earned by North Korean IT workers using false identities and working as remote contractors at blockchain firms.

The post US Imposes Sanctions on North Korean IT Group over Cryptocurrency Heists appeared first on Crypto Market Insights: Dive In with CryptoUpdate.io.

On May 15, Paraguayan prosecutor Irene Rolón released a statement detailing that the individuals were apprehended shortly after infiltrating a locked area of Teratech SA, a local technology company based in Coronel Bogado. It is suspected that the individuals may have been affiliated with Teratech as freelance contractors, but this information awaits confirmation from the company’s CEO.

The three extradited individuals, Jinping Duan, Tian Jianyun, and Zheng Guanglong, are Chinese nationals who lacked official entry records into Paraguay. Both Paraguayan authorities and Interpol suspect they might have entered illegally through Brazil or Bolivia.

The fourth person, Nahun María Velázquez Garcete, is a legal resident of Paraguay and believed to be associated with a criminal organization. Charged with aggravated theft, he is currently in pretrial detention. He was rushed to the hospital in critical condition shortly after the arrest, however, the nature of his injuries remains undisclosed.

Paraguayan officials are investigating whether other individuals were involved in the attempted heist, with the investigation ongoing. Prosecutor Rolón suggests that the extradited individuals may have been illegally working in Paraguay for several months, potentially as programmers. It remains uncertain if their work was related to the company.

Paraguay’s abundant renewable energy resources make it an attractive hub for cryptocurrency mining operations. The Itaipu dam, which supplies all of Paraguay’s local electricity needs and generates ample excess electricity, is increasingly popular among miners.

The post Paraguay Extradites Three Suspects Following Attempted Cryptocurrency Mining Heist appeared first on Crypto Market Insights: Dive In with CryptoUpdate.io.

The unfortunate victim was driven for an hour across the Arizona border to a remote desert location. The teens then allegedly forced him to relinquish access to his digital financial accounts, which led to the theft of NFTs and cryptocurrency valued at a staggering $4 million.

A third accomplice, also a teenager, is currently facing charges but is reportedly no longer residing in the United States, as per the prosecutor’s statement. The first report of the case emerged from a Las Vegas local news outlet, 8newsnow.

Reports suggest that the teens may have received assistance from a person communicating with them over speakerphone. After the ordeal, the victim had to traverse five miles across the desert alone to reach a gas station and call a friend for help.

One of the 16-year-olds has engaged the services of renowned defense attorney Ross C. Goodman, as shown by Las Vegas court records. The other teen has sought the assistance of a public defender. No comments have been received from Goodman’s office yet.

This incident marks the latest in a worrying trend of violent crimes targeted at individuals with substantial cryptocurrency holdings. Earlier this year, the co-founder of Ledger was kidnapped and tortured in France, with the criminals demanding a hefty cryptocurrency ransom. Furthermore, a Canadian man was reportedly forced into hiding after being targeted for a kidnapping attempt due to his perceived bitcoin wealth.

Disclaimer: The Block is an independent media outlet offering news, research, and data. As of November 2023, Foresight Ventures is a majority investor in The Block. The Block continues to operate independently, delivering objective, impactful, and timely information about the crypto industry.

The post Crypto Heist: Florida Teenagers Face 22 Felony Charges Over $4M Crypto and NFT Theft appeared first on Crypto Market Insights: Dive In with CryptoUpdate.io.

Unraveling the Hack Behind the Bitcoin Fee Anomaly

The user, known on social media as “@83_5BTC,” reported that after transferring 139 BTC to a new cold wallet, hackers immediately redirected the funds to another wallet. In this transaction, 55.77 BTC went to the hackers, while an astonishing 83.65 BTC was paid as a transaction fee, surpassing the previous record fee of 19.8 BTC.

Mononaut, a prominent figure in the Bitcoin community and operator of the mempool.space Bitcoin explorer, offered insights into the incident. He suggested that the wallet’s vulnerability stemmed from “bad entropy,” implying weak randomization during its creation, which compromised its security.

The situation was further complicated by the “replace-by-fee” (RBF) method used to escalate the transaction’s priority. Mononaut theorized that if the wallet had low entropy, it could have been a target for multiple attackers, each trying to outbid the other with higher transaction fees.

The alleged victim, @83_5BTC, tried to establish ownership of the compromised wallet by sharing a signed message on social media. While Mononaut verified the message, he warned that it’s unclear whether the victim or the hacker signed it, adding to the complexity of the situation and the uncertainty around the potential recovery of the fees by Antpool.

The Importance of Wallet Security and Proper Entropy

This incident has brought to light the critical importance of wallet security in the cryptocurrency space. Mononaut’s advice underscores the need for robust entropy in wallet creation, especially for handling large sums, and the potential benefits of using multisig (multiple signature) wallets for enhanced security.

The post Bitcoin User’s Hack Linked to Enormous 83.65 BTC Fee Incident appeared first on Crypto Market Insights: Dive In with CryptoUpdate.io.