The People Behind the Hacks: Who Is Stealing Solana Wallets?
By [Your Name] – Security Research Team
Introduction
From state-sponsored hacking groups to independent cybercriminals, the actors targeting Solana wallets are diverse. Recent arrests in 2026 have shed light on their identities, ages, and methods. This post profiles the main threat actors and the law enforcement agencies hunting them.
State-Sponsored Actors
| Group | Origin | Primary Targets | Current Status |
|---|---|---|---|
| Lazarus Group | North Korea | Major exchange hacks (Bybit $1.5B) | Actively operating |
| Andariel / APT38 | North Korea | Financial institutions, crypto exchanges | Active |
The Lazarus Group was formally attributed by the FBI to the February 2025 Bybit hack—the largest crypto theft in history. Stolen funds (estimated at 13,562 BTC) are believed to finance North Korea’s weapons programs.
Recent Arrests (2026)
| Name/Alias | Age | Role | Crime | Location |
|---|---|---|---|---|
| John Daghita (“Lick”) | ~20s-30s | Government contractor | Stole $46M from US Marshals wallet | Saint Martin |
| “A” (Leader) | 41 | Phishing ring leader | Stole $600K in USDT | South Korea/Vietnam |
| “B” (Developer) | 34 | Built phishing infrastructure | Same ring | South Korea/Vietnam |
The John Daghita Case
Daghita abused access at his father’s company, CMDSS, which held a contract with the U.S. Marshals Service to manage seized crypto assets. He stole $46 million, bragged on Telegram as “Lick,” and was traced by on-chain investigator ZachXBT. He was arrested in Saint Martin by the French Gendarmerie with FBI coordination.
South Korean Phishing Ring
Seven members were arrested after stealing 800 million Korean won (~$600,000) using fake investment sites. They laundered funds through currency exchangers. A joint operation with Vietnamese police led to the arrests.
Government Agencies Hunting Hackers
| Country | Agency | Role |
|---|---|---|
| US | FBI, DOJ, US Marshals | Attribution, arrests, asset seizure |
| UK | NCA, OFSI, HMRC | Crypto Cash Fusion Cell (multi-agency) |
| South Korea | Seoul Police | Local and international coordination |
| International | Interpol, Europol | Global red notices, cooperation |
The Role of On-Chain Detectives
Independent investigators like ZachXBT have become crucial in tracing stolen funds and identifying criminals. Blockchain transparency cuts both ways—it helps law enforcement as much as it enables crime.
