On-chain sleuth ZachXBT just exposed a crypto thief who couldn’t keep his mouth shut. He goes by John (Lick) and just got caught showing off $23 million in crypto that’s now linked to more than $90 million in stolen funds.
That includes money from a U.S. government wallet. The receipts are all on-chain, and the story started when John got into a stupid flex-off in a Telegram chat.
Earlier that day, John started arguing with another scammer, Dritan Kapplani Jr., about who had more crypto. In their world, it’s called band for band, or b4b. The chat was recorded from start to finish.
In the first part, Dritan kept clowning John. So John shared his screen to show off his Exodus Wallet. One address, a Tron wallet, had $2.3 million sitting in it: TMrWCLMS3ibDbKLcnNYhLggohRuLUSoHJg.
John’s wallets show direct links to seized U.S. funds and past thefts
In the second part of the call, Dritan kept trolling him while another $6.7 million in ETH landed in a different wallet: 0xd8bc7ea538c2e9f178a18cc148892ae914a55d08. By the time the show-off ended, John had pulled together $23 million in total into that same address. He fully controlled it and the Tron one too. All of that got captured in the video.
Zach didn’t stop there. He went back through the transactions. That 0xd8bc address had received crypto from another wallet: 0x8924. In the recording, John said out loud that he owned that one too. On November 20, 2025, 0x8924 received 1,066 WETH from a third wallet: 0xc7a2. The transaction ID was 0x76c6e92c4cefda209263a214241f1b47b9cff0123e9d292d613aea3447466dd0.
That 0xc7a2 wallet had previously received $24.9 million from a U.S. government wallet back in March 2024. That transaction was tied to funds the government seized in the Bitfinex hack. Zach had already flagged that same address in a post from October 2024. Today, $18.5 million still sits in 0xc7A253fD3C61CF69d043e6184c107dF4E29475B5.
More red flags showed up. That same 0xd8bc wallet is linked to $63 million from sketchy wallets during Q4 2025. Here’s the breakdown, according to Zach:
- $13.5 million from
0x77a722bf33787c3512d0f4fc36412140057f4223 - $15.4 million from
0xf51b044f998277b17467cd713d72b403e16fad48 - $3 million from
TACZPnbg2Fi2ppC3cGxQxZb95SqwAZVAw9 - $1 million from
6tMdWb3w3UaVq4JRSm1qa2s8mVwj2MYFAveJEL6S93Ua
Then there’s today’s activity. 4,170 ETH, worth about $12.4 million, came from MEXC into the same 0xd8bc wallet. The ETH passed through this wallet: 0xe0f7a45a491d53f9361d35b4ef9908986d3b37b7.
John clearly doesn’t hide. His Telegram account has a long history of bragging about how rich he is and calling people broke. His username is tied to TG ID 8269661864. After the post by Zach, he quickly wiped out his NFT usernames and changed his screenname, but it was too late.
“Rumors circulating from cybercrime Telegram channels indicate John could be John Daghitia who was previously arrested in Sep 2025. Though more research is needed to fully confirm,” said Zach.
To top it off, someone used one of the theft wallets to send dust to zachxbt.eth as a response to the thread. The transaction hash was 0x25d3b02b17ccf5f0867bfbaa86c4cb918766d2b79e30cdcb7847298febfa2d15.
If you’re reading this, you’re already ahead. Stay there with our newsletter.
Source: https://www.cryptopolitan.com/zachxbt-threat-actor-john-lick-tied-to-90m/
