Archived tweet

Tweet thread by zachxbt:

1/ Meet the threat actor John (Lick), who was caught flexing $23M in a wallet address directly tied to $90M+ in suspected thefts from the US Government in 2024 and multiple other unidentified victims from Nov 2025 to Dec 2025. Tweeted Jan 23, 2026 2/ Earlier today John got into a heated argument with another threat actor known as Dritan Kapplani Jr. in a group chat to see who had more funds in crypto wallets. In 'The Com' this is known as a band for band (b4b). However the entire interaction was fully recorded. Tweeted Jan 23, 2026 3/ In part 1 of the recording Dritan mocks John however John screenshares Exodus Wallet which shows the Tron address below with $2.3M: TMrWCLMS3ibDbKLcnNYhLggohRuLUSoHJg Tweeted Jan 23, 2026 4/ In part 2 of the recording Dritan continues to mock John while another $6.7M worth of ETH is moved into the wallet address below: 0xd8bc7ea538c2e9f178a18cc148892ae914a55d08 Tweeted Jan 23, 2026 5/ After the B4B was done John had moved ~$23M total to 0xd8bc. The recording captures that John clearly controls both addresses. Additional addresses can likely be found in the recordings. I then began tracing backwards to verify the source of funds. Tweeted Jan 23, 2026 6/ 0xd8bc receives from 0x8924 which in the recording John confirms owning. 0x8924 received 1066 WETH from 0xc7a2 on Nov 20, 2025 in the following txn. 0x76c6e92c4cefda209263a214241f1b47b9cff0123e9d292d613aea3447466dd0 Tweeted Jan 23, 2026 7/ 0xc7a2 received $24.9M from a US Government address in March 2024 related to the Bitfinex hack seizure which is a theft from the USG I previously reported about in Oct 2024. $18.5M currently sits at 0xc7A253fD3C61CF69d043e6184c107dF4E29475B5 Tweeted Jan 23, 2026 8/ 0xd8bc is tied to $63M+ inflows from suspected victims and government seizure addresses in Q4 2025. Dec 2025 $13.5M 0x77a722bf33787c3512d0f4fc36412140057f4223 $15.4M 0xf51b044f998277b17467cd713d72b403e16fad48 Nov 2025 $3M TACZPnbg2Fi2ppC3cGxQxZb95SqwAZVAw9 $1M 6tMdWb3w3UaVq4JRSm1qa2s8mVwj2MYFAveJEL6S93Ua Tweeted Jan 23, 2026 9/ Another 4.17K ETH ($12.4M) was received from MEXC earlier today flowing to 0xd8bc 0xe0f7a45a491d53f9361d35b4ef9908986d3b37b7 John has an extensive message history on Telegram flaunting his networth and calling others broke. TG ID: 8269661864 Tweeted Jan 23, 2026 10/ Rumors circulating from cybercrime Telegram channels indicate John could be John Daghitia who was previously arrested in Sep 2025. Though more research is needed to fully confirm. 11/ Threat actors only continue to showing off stolen funds in leaked recordings rather than simply just staying quiet after an alleged theft from the US Government. In this case John was ragebaited by Dritan into going band for band and the proof of ownership for these wallets makes it an easy future case for law enforcement. Show more Tweeted Jan 23, 2026 Update: John quickly removed all of the NFT usernames from his Telegram account and change his screenname after my post. Tweeted Jan 23, 2026 Update: John dusted my public address zachxbt.eth from one of the theft addresses. Transaction hash 0x25d3b02b17ccf5f0867bfbaa86c4cb918766d2b79e30cdcb7847298febfa2d15 Tweeted Jan 23, 2026

Tweet #1

Image #1:

Image

Image #2:

Image

Image #3:

Image

Image #4:

Image

Image #5:

Image

Image #6:

Image

Image #7:

Image

Image #8:

Image

Image #9:

Image

Image #10:

Image

Image #11:

Image

Image #12:

Image

Image #13:

Image

Image #14:

Image

Image #15:

Image

Image #16:

Image

Image #17:

Image

Image #18:

Image