Rage-Baited Flex Exposes $90M+ In Suspected Theft Tied To U.S. Government Seizure

A bizarre moment of online bravado has unraveled into one of the clearest on-chain exposures of a major crypto threat actor in recent months.

A figure known as John, also referred to as “Lick”, was reportedly rage-baited into a live “band for band” wallet flex, a showdown popular in cybercrime circles, ultimately revealing wallets now linked to over $90 million in suspected thefts, including funds tied to a U.S. government seizure related to the Bitfinex hack.

The incident, documented and traced by on-chain investigator @zachxbt, highlights a recurring pattern in crypto crime: threat actors undermining their own operational security by publicly flaunting stolen funds. In this case, the fallout may be severe, as the recordings provide unusually strong proof of wallet ownership, potentially simplifying future law enforcement action.

The “Band For Band” That Went Wrong

The exposure began with a heated argument in a private group chat between John and another known threat actor, Dritan Kapplani Jr. The dispute escalated into what insiders refer to as a “band for band” (b4b), essentially a wallet flex to prove who controls more crypto.

Crucially, the entire interaction was recorded.

In Part 1 of the recording, Dritan mocks John, prompting John to screen-share his Exodus wallet. The screen capture shows a TRON address holding roughly $2.3 million: TMrWCLMS3ibDbKLcnNYhLggohRuLUSoHJg

Rather than ending the exchange, the flex continued.

In Part 2, as Dritan keeps taunting him, another $6.7 million worth of ETH is transferred live into an Ethereum wallet: 0xd8bc7ea538c2e9f178a18cc148892ae914a55d08

By the end of the b4b, John had moved approximately $23 million into the 0xd8bc address. The recordings clearly show John controlling both the TRON and Ethereum wallets, leaving little ambiguity around ownership.

On-Chain Tracing Reveals The Bigger Picture

Following the recordings, ZachXBT began tracing the funds backward to verify their origin. What emerged was a web of transactions directly connected to government-seized assets and suspected victim funds.

The wallet 0xd8bc receives funds from another address, 0x8924, which John explicitly confirms in the recording that he owns. That address, in turn, received 1,066 WETH on November 20, 2025, from:

0xc7a2, via transaction

0x76c6e92c4cefda209263a214241f1b47b9cff0123e9d292d613aea3447466dd0

The trail becomes far more serious at this point.

Address 0xc7a2 received $24.9 million from a U.S. Government–controlled wallet in March 2024, linked to the Bitfinex hack seizure. This transfer was previously reported by ZachXBT in October 2024 as a suspected theft from U.S. government custody.

As of now, $18.5 million still sits at: 0xc7A253fD3C61CF69d043e6184c107dF4E29475B5

This connection elevates the case beyond ordinary crypto theft, directly tying John’s wallets to assets associated with one of the most high-profile seizures in crypto history.

$63M+ In Additional Suspected Victim Inflows

The exposure does not stop with the Bitfinex-related funds. According to on-chain data, 0xd8bc is tied to more than $63 million in inflows from suspected victims and government-linked addresses during Q4 2025 alone.

Breakdown of notable inflows includes:

December 2025

$13.5M from 0x77a722bf33787c3512d0f4fc36412140057f4223

$15.4M from 0xf51b044f998277b17467cd713d72b403e16fad48

November 2025

TACZPnbg2Fi2ppC3cGxQxZb95SqwAZVAw9

6tMdWb3w3UaVq4JRSm1qa2s8mVwj2MYFAveJEL6S93Ua

In addition, 4,170 ETH (roughly $12.4 million) flowed from MEXC earlier the same day into 0xd8bc, via: 0xe0f7a45a491d53f9361d35b4ef9908986d3b37b7

Taken together, these flows suggest systematic aggregation of stolen funds, rather than a one-off incident.

Online Bravado And A Growing Trail

Beyond on-chain evidence, John reportedly maintains an extensive Telegram message history where he openly flaunts his net worth, mocks others as “broke,” and boasts about his holdings. This public behavior has only amplified scrutiny from investigators and rival threat actors alike.

Rumors circulating within cybercrime Telegram channels suggest John may be John Daghitia, an individual who was reportedly arrested in September 2025. While this identity has not yet been conclusively confirmed, the overlap has raised further interest in the case and underscores the likelihood that authorities are already familiar with the actor.

ZachXBT noted that additional wallet addresses may be identifiable by further analyzing the recordings, suggesting that the $90M+ figure could still rise as more links are uncovered.

Why This Case Is Different

Crypto crime is not new, but this case stands out for one reason: proof of ownership.

Threat actors typically rely on plausible deniability, fragmented wallets, and silence after major thefts. In contrast, John’s decision to live-share wallets during a rage-fueled flex provides rare, direct evidence tying a real individual to specific addresses. This significantly lowers the burden for future legal action.

As ZachXBT pointed out, threat actors continue to make the same mistake, showing off stolen funds instead of staying quiet. In this instance, being rage-baited by a rival turned into a self-inflicted exposure that may follow John for years.

The Bottom Line

What began as an ego-driven “band for band” flex has evolved into a detailed on-chain case linking a single actor to government-seized funds, exchange inflows, and tens of millions in suspected victim losses. With recordings, wallet confirmations, and transaction trails now public, this incident represents one of the clearest examples of how social behavior and blockchain transparency collide.

For law enforcement, the work has arguably been made easier. For the crypto ecosystem, it’s another reminder that on-chain footprints don’t fade, and that bravado in private chats can quickly become evidence in public investigations.

Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.

Follow us on Twitter @nulltxnews to stay updated with the latest Crypto, NFT, AI, Cybersecurity, Distributed Computing, and Metaverse news!