ZachXBT Links Flashy Wallets to Suspected $90M U.S. Government Theft

ZachXBT, a well-known crypto investigator, has linked a threat actor called John, also known as Lick, to wallets holding millions in crypto. ​​The findings connect John to more than $90 million in suspected stolen funds, including money linked to a U.S. government seizure address.

Moreover, the investigation gained momentum after a recorded group chat incident exposed wallet ownership in real time. Consequently, the leaked footage may create a clear trail for future law enforcement action.

Recorded “Band for Band” Sparks Wallet Exposure

ZachXBT reported that John entered a heated argument with another threat actor, Dritan Kapplani Jr., in a group chat. In the cybercrime scene called The Com, this kind of showdown is known as band for band, or b4b. Additionally, the full interaction was recorded, which made the dispute more than just talk.

During the first part, John screen shared an Exodus Wallet balance linked to a Tron address. The address shown was TMrWCLMS3ibDbKLcnNYhLggohRuLUSoHJg, which held about $2.3 million. However, the second part escalated fast, as more funds moved during the exchange.

While Dritan continued mocking John, another wallet received about $6.7 million in ETH. That wallet address was 0xd8bc7ea538c2e9f178a18cc148892ae914a55d08. Besides that, ZachXBT said John later moved around $23 million total into the 0xd8bc wallet. Hence, the recording appeared to show John controlling both addresses.

Tracing the Source of Funds

ZachXBT then traced transactions backward to verify where the funds originated. The wallet 0xd8bc reportedly received funds from 0x8924, which John confirmed as his own. Additionally, 0x8924 received 1,066 WETH from 0xc7a2 on Nov. 20, 2025.

ZachXBT said 0xc7a2 had earlier received $24.9 million from a U.S. Government address in March 2024. That address related to a Bitfinex hack seizure case ZachXBT had flagged in Oct. 2024. Significantly, around $18.5 million still sits at 0xc7A253fD3C61CF69d043e6184c107dF4E29475B5.

ZachXBT also linked 0xd8bc to more than $63 million in inflows during Q4 2025. Moreover, inflows reportedly included funds from suspected victims and government seizure-related addresses.

New Leads and a Rapid Online Cleanup

Further inflows appeared in Nov. and Dec. 2025 across several addresses. Additionally, ZachXBT noted another 4.17K ETH, worth about $12.4 million, flowed from MEXC into 0xd8bc. That transfer came from 0xe0f7a45a491d53f9361d35b4ef9908986d3b37b7.

ZachXBT also reported John had a long Telegram history of showing off wealth and mocking others. The Telegram ID linked to John was 8269661864. Rumors also suggested John could be John Daghitia, who was arrested in Sep. 2025. However, ZachXBT said more work is needed to confirm that identity.

After ZachXBT posted the findings, John reportedly removed NFT usernames and changed his Telegram screen name. Consequently, the quick cleanup suggested growing pressure as public attention increased.

Related: Crypto Investigator ZachXBT Warns of a Fake Hyperliquid App on Google Play Store