A thief who steals from a thief is forgiven for 100 years, the popular saying goes. What happens when a third thief enters the equation and the one robbed is the United States government?
Although it is not yet officially confirmed, researcher ZachXBT presents solid evidence that suggests that John Daghita, son of the owner and CEO of CMDSS (Command Services & Support), stole between USD 40 and 90 million in cryptocurrencies confiscated by the United States government.
CMDSS is a company with an active contract in Virginia with the United States Marshals Service (USMS) to assist in the management and disposition of seized cryptocurrency. The details about the case were already exposed by NoticiasVE in another article. What is interesting here is what this apparent theft tells us about cryptocurrency custody.
Cryptocurrencies are bearer assets. Whoever has the keys to sign a transaction is its de facto owner. There is nothing to prevent him from moving that money at will, even if it is to steal it. And once stolen, there is no reverse transaction button that can remotely undo the damage.
That is why a custody system, At a minimum, it should be multi-signature. A single entity should not be able to move third-party funds at its discretion. At the very least, and it would still be a very low security system, two signatories should be required to approve a transaction.
Custody companies with robust standards also include other technologies: Multi-Party Computation or Threshold Signature Schemes, where the private key never exists in its entirety but is divided into partitions that are only combined for signing; Hardware Security Modules to securely generate and store keys; geographical distribution of keys; white lists of withdrawal addresses; video verification to approve movements; biometric approval; hash and time locks; inter alia.
This is not a whim or paranoia, it is a necessity in the face of a growing number of cybercrimes. However, in the United States, there is no single federal law that comprehensively regulates all cryptocurrency custodians in a uniform manner. Instead, obligations depend on the type of entity, the client it serves, and the jurisdiction (federal or state).
When the client is the US Marshals Service and the assets are seized cryptocurrencies, demands seem more flexible. Although the Contract Opportunity published on SAM.gov required “the use of multiple industry-leading storage and settlement techniques employed in a manner that is professional, legal, and consistent with Department and USMS policy,” the appeal filed by Wave Digital Assets when they awarded the contract to CMDSS suggests more laxity.
In July 2025, Wave alleged that the contract award was due to an unfair evaluation process, which violated federal contracting law by failing to evaluate the conflict of interest arising from employing a former USMS worker. It also argued that the competing supplier lacked the necessary licenses and should therefore have been disqualified. However, the Court of Federal Claims denied the injunction, stating that CMDSS complied with the terms of the call.
This shows laxity in contractor selection: the same level of SOC 2 audits, mass insurance or strict segregation is not required as a private qualified custodian, when the seized assets are of equal relevance.
There is little that can be investigated about CMDSS since they closed all their networks after the ZachXBT complaint. They only left their website online, which is literally unnavigable, a basic landing page made with stock images that does not speak well of their technological capabilities.
Are US Cryptocurrencies Safe?
This whole case opens up a lot of questions. How did that child have access to the cryptocurrencies guarded by his father’s company? Did the company keep all those millions on the father’s laptop at home? Was there only one key? No private credentials were required to access the wallet? Was the father involved?
All of those questions are intriguing and will likely be answered when the Sheriff’s Department completes its investigation into the case. But there are bigger questions to answer regarding the custody of confiscated funds in the United States.
Who will investigate US Marshals for laxity in choosing their contractors? What security standards should confiscated funds custody companies meet? What licenses should they have? Are confiscated funds safe in the United States?
Let’s remember the problems the United States Marshals Service had in confirming how many cryptocurrencies it had. And although on March 11, 2025, all US agencies were required to report how many cryptocurrencies they held within 30 to 90 days, that information has not yet been made public.
The only way for people to know about the funds managed by the United States is through research by analysts like ZachXBT and analysis companies like Arkham, according to which they manage almost 30 billion in different cryptocurrencies. If it were not for the transparency of these networks, thefts like the one Daghita allegedly carried out would be a mystery for public scrutiny.
The truth is that this case calls into question the seriousness with which government agencies handle the custody of their cryptocurrencies and raises the question about how they would handle the supposed Bitcoin Reserve that they have been promising since Donald Trump’s campaign.
We close with another couple of questions: what will happen when all governments in the world realize the scarcity of bitcoin and the race for the asset intensifies? How will funds be protected when they know there is not enough bitcoin to go around?
Disclaimer: The views and opinions expressed in this article belong to its author and do not necessarily reflect those of NoticiasVE. The author’s opinion is for informational purposes and under no circumstances constitutes an investment recommendation or financial advice.