Original | Odaily Planet Daily (@OdailyChina)
Author | Asher (@Asher_0210)
Last night, blockchain detective ZachXBT revealed an 18-year-old hacker from the U.S., Dritan Kapllani Jr. According to the information disclosed, this young man, Dritan Kapllani Jr., is suspected of participating in multiple social engineering attacks targeting crypto users, with a total involved amount of about $19 million. Although he has not yet been formally charged, he has already been included in the 'co-conspirator' category within U.S. judicial documents.
This case quickly caught the spotlight, not just because of the massive amount involved, but because its origin is highly dramatic—a voice call meant to flaunt wealth became the breakthrough of the entire investigation.
Just flexed once on Discord.
On April 23, 2026, a dispute in a Discord voice channel kicked off this whole saga.
It was a voice call known as 'Band 4 Band', where participants directly compared their 'power'—showing off their held assets. The atmosphere quickly shifted from teasing to competitive, and driven by this sentiment, Dritan shared his screen to prove he was wealthier, showcasing his Exodus wallet interface with a balance of about $3.68 million.
Weeks later, this narrative was flipped on its head. On-chain detective ZachXBT started tracing from this address, linking previously scattered transactions one by one, revealing a longer funding path.
A stash of 185 BTC from a heist has come to light.
Flashback to March 14, 2026, when a social engineering heist involving 185 BTC occurred, valued at around $13 million at the time. The funds were quickly transferred out of the original address and rapidly entered an on-chain diversion system.
Just the next day, around $5.3 million was transferred into the wallet Dritan showcased during a Discord voice call (address: 0x4487db847db2fc99372a985743a26f46e0b2bba6). In the following weeks, this approximately $5.3 million was continually split and transferred through multiple addresses, flowing to different destinations. By the time of the voice call on April 23, about $1.6 million had been further transferred.
This isn't Dritan's first rodeo in crypto heists.
Tracing back through Dritan's displayed wallet address quickly reveals that the funds there come from more than just the 185 BTC heist.
According to on-chain analysis, the funds in this wallet can be traced back to several social engineering heists in 2025, totaling over $5.85 million. Different victims, different times, but once the funds were transferred out, they would be quickly split and continue moving through a string of addresses, following a very similar path. When matching these funds transaction by transaction, you'll find that many transfers ultimately land in Dritan's displayed wallet address.
Notably, Dritan had a 'Band 4 Band' spat with hacker John Daghita (Lick). Lick was later arrested for allegedly stealing around $46 million in U.S. government funds, and in a now-deleted Telegram post, he publicly revealed Dritan's old address (address: 0x97da0685dbba50b4cbabb0ca9e8336f4fbe41122), which seems more like a revenge move now.
From on-chain behavior, the old address's method of fund splitting, transfer paths, and subsequent flows are highly consistent with the funds flowing into Dritan's displayed wallet, suggesting it was used by the same controlling party.
Judicial documents first 'name names'.
It wasn't until May 11, 2026, that this on-chain funding path was officially confirmed in judicial documents. That day, the indictment against Trenton Johnson was unsealed. He was charged for his role in the 185 BTC heist and faces up to 40 years in prison.
In the indictment, a key co-conspirator is labeled as 'Co-Conspirator 1 (CC-1)', and the on-chain analysis community has pointed the finger at Dritan Kapllani Jr. While Dritan hasn't been formally charged yet, he's been woven into the judicial narrative's 'conspiracy structure' through inferred 'associated addresses'.
Moreover, the same document mentions another individual involved—Meme coin KOL yelotree—who is accused of aiding money laundering through his car rental business in Miami and faces up to 30 years in prison.
Now that he's 18, the extravagant lifestyle comes to a halt.
Previously, Dritan lived a lavish life, constantly posting related content on Instagram and interacting with other hackers via Telegram. In hacker circles, he was once seen as having a certain 'main character glow'—with multiple associated groups (like ACG, 41 / RM Boyz, etc.) being taken down by law enforcement, while he remained untouched.
However, this 'glow' came to an end when he turned 18, and past actions began to face legal scrutiny.