Prominent on-chain investigator ZachXBT has publicly exposed an individual known as John (also referred to as Lick), linking him to cryptocurrency wallets containing over $90 million in suspected stolen funds. The investigation was triggered by a recorded Telegram group chat where John engaged in a "band for band" (b4b) boasting contest with another alleged scammer, Dritan Kapplani Jr.
During the chat, John shared his screen, revealing control of a Tron (TRX) wallet containing $2.3 million and an Ethereum wallet that received an additional $6.7 million in ETH during the call. By the end of the display, he had demonstrated control of approximately $23 million across these addresses. The video evidence provided a clear, real-time link between John and the wallets.
ZachXBT then conducted a forensic on-chain analysis, tracing transactions backward from the exposed wallets. This investigation revealed that one of John's Ethereum addresses (0xd8bc...) received funds from another wallet (0x8924) he also claimed to own. Crucially, wallet 0x8924 had received 1,066 WETH from a third address (0xc7a2) in November 2025.
The 0xc7a2 wallet had previously received $24.9 million from a confirmed U.S. government seizure wallet in March 2024, funds originally linked to the 2016 Bitfinex hack. As of the report, $18.5 million remains in that government-linked address. Further analysis connected John's 0xd8bc wallet to an additional $63 million from other suspicious wallets in Q4 2025 and a recent inflow of 4,170 ETH (worth ~$12.4 million) from the MEXC exchange.
Following ZachXBT's public post, John rapidly scrubbed his Telegram account, deleting NFT usernames and changing his screen name. ZachXBT noted, "Rumors circulating from cybercrime Telegram channels indicate John could be John Daghitia who was previously arrested in Sep 2025. Though more research is needed to fully confirm." In a defiant act, one of the associated wallets sent a dust transaction to zachxbt.eth in response to the exposure.
