ZachXBT reports receiving 0.6767 ETH worth about $2,000 from stolen U.S. government funds, linked to prior wallet breaches.
0.6767 ETH from stolen U.S. government funds has landed in the public wallet of blockchain investigator ZachXBT.
The transfer, disclosed on January 26, 2026, was traced to a threat actor linked to earlier government wallet breaches.
Transfer of 0.6767 ETH to a Public Wallet
On January 26, 2026, blockchain investigator ZachXBT disclosed that he received 0.6767 ETH in his public wallet.
According to Cointelegraph, the ether was valued at about $2,000 at the time of the transfer, based on market prices.
🚨 JUST IN: ZachXBT says 0.6767 $ETH in stolen US govt funds was sent to his public wallet by John (Lick). pic.twitter.com/18lCTrf8N2
— Cointelegraph (@Cointelegraph) January 26, 2026
ZachXBT stated that the funds were sent by an individual using the name John Daghita. He said Daghita is also known online by the aliases “John” and “Lick,” which have appeared in prior online discussions.
According to ZachXBT, the ether was transferred without prior contact or consent.
He explained that the transaction occurred during an online dispute involving individuals linked to cybercrime activity.
ZachXBT said the sender used the transfer as a public display of wallet control. He described the action as part of an attempt to show access to funds during the dispute.
The investigator stated that the ether originated from stolen U.S. government funds.
He linked the transaction to addresses connected to earlier breaches of government-controlled wallets.
ZachXBT also said he does not intend to keep the funds. He announced plans to forward the 0.6767 ETH to an official U.S. government seizure address once the process is completed.
“Band for Band” Dispute and Wallet Exposure
The transfer followed a recorded argument that took place in a Telegram group chat. The discussion involved two individuals known within online cybercrime communities.
The exchange centered on a dispute commonly referred to as “band for band.” This term is used to describe situations where participants display wallet balances. The goal is to show control over large amounts of cryptocurrency.
Both individuals attempted to demonstrate financial dominance during the exchange. Wallet screenshots and live transfers were used to support their claims.
During the chat, the individual known as “Lick” shared his screen with the group. He displayed an Exodus wallet interface during the recording.
The shared wallet showed a Tron blockchain address. The address held cryptocurrency valued at approximately $2.3 million at the time of the dispute.
The screen sharing allowed viewers to see the wallet balance in real time. The display was later used by investigators to trace related blockchain activity.
Related Reading: ZachXBT Identifies Suspicious Address Linked to Hundreds of Crypto Wallets Losing Funds Across Chains
Link to Earlier Government Wallet Breach
According to ZachXBT, the traced address had received about $24.9 million in March 2024 from a U.S. government wallet. That wallet held digital assets seized during prior criminal investigations.
7/ 0xc7a2 received $24.9M from a US Government address in March 2024 related to the Bitfinex hack seizure which is a theft from the USG I previously reported about in Oct 2024.
$18.5M currently sits at
0xc7A253fD3C61CF69d043e6184c107dF4E29475B5 pic.twitter.com/N9hxwf4Dc9— ZachXBT (@zachxbt) January 23, 2026
Blockchain records show the funds originated from wallets linked to the Bitfinex hack seizure. Those assets had been under government control following earlier recovery efforts.
ZachXBT had previously monitored activity tied to these wallets. In October 2024, he reported unusual and unexpected movements involving the seized funds.
During that period, roughly $20 million was transferred out of government-controlled addresses. The movements raised concerns due to their speed and lack of public explanation.
Most of the transferred funds were returned within 24 hours. However, about $700,000 sent through instant exchange services was not recovered.
The remaining missing funds were difficult to trace due to rapid swaps. Blockchain data showed they passed through services with limited transparency.
