Original | Odaily Planet Daily ( @OdailyChina )

Author | Asher ( @Asher_0210 )

Last night, on-chain investigator ZachXBT revealed an 18-year-old hacker from the United States named Dritan Kapllani Jr. According to the disclosed information, this young man named Dritan Kapllani Jr. is suspected of participating in multiple social engineering attacks targeting crypto users, with a total involved amount of approximately 19 million dollars. Although he has not been formally charged yet, he has already been included in the scope of "co-conspirators" in U.S. judicial documents.

This case quickly garnered attention, not only because of the large sum involved but also because its starting point is highly dramatic — a voice call originally intended to flaunt wealth became the breakthrough in the entire investigation.

Just flaunting wealth on Discord

On April 23, 2026, a dispute that occurred in a Discord voice channel opened the curtain on this matter.

It was a voice call called “Band 4 Band,” where participants compared each other's "capabilities" in the most straightforward way — showcasing their owned assets. The atmosphere quickly shifted from teasing to competition. Driven by this emotion, Dritan, in an effort to prove he was wealthier, directly started screen sharing to show his Exodus wallet interface, with a balance of about 3.68 million dollars.

Weeks later, this scene was revisited. On-chain investigator ZachXBT took this address as a starting point, linking the originally scattered transactions one by one, which gradually revealed a longer fund path.

A theft of 185 bitcoins surfaced

Turning back to March 14, 2026, a social engineering theft involving 185 bitcoins occurred, valued at around 13 million dollars at the time. The funds were quickly transferred out of the original address and swiftly entered an on-chain diversion system.

The very next day, about 5.3 million dollars of the stolen amount was transferred to Dritan's wallet displayed during the Discord voice call (address: 0x4487db847db2fc99372a985743a26f46e0b2bba6). In the following weeks, this approximately 5.3 million dollars was continuously split across multiple addresses and transferred to different destinations. By the time the voice conversation occurred on April 23, about 1.6 million dollars had been further transferred.

This is not the first time involved in crypto theft

Tracing back the wallet address that Dritan displayed, it quickly became apparent that the funds in it did not only come from the theft of 185 bitcoins.

According to on-chain analysis, the sources of this wallet's funds can be traced back to multiple social engineering thefts in 2025, with a total amount exceeding 5.85 million dollars. Different victims, different times, but after the funds were transferred out, they would be quickly split and transferred through a series of similar paths. When matching these funds one by one, it is found that many transfers ultimately ended up in this wallet address displayed by Dritan.

Notably, Dritan had a "Band 4 Band" dispute with hacker John Daghita (Lick). Lick was later arrested for allegedly stealing approximately 46 million dollars in U.S. government funds, and in a subsequently deleted Telegram post, he publicly revealed Dritan's old address (address: 0x97da0685dbba50b4cbabb0ca9e8336f4fbe41122), which seems more like an act of revenge now.

From on-chain behavior, this old address has a highly consistent pattern in fund splitting methods, transfer paths, and subsequent flows with the funds in Dritan’s displayed wallet, thus it is considered to be used by the same controlling party.

Judicial documents "name" for the first time

Until May 11, 2026, this on-chain fund path was officially confirmed for the first time in judicial documents. On that day, the criminal indictment against Trenton Johnson was unsealed. He was charged for participating in the theft of 185 bitcoins and faces up to 40 years in prison.

In the indictment, a key co-conspirator was marked as “Co-Conspirator 1 (CC-1),” and the on-chain analysis community has pointed this identity towards Dritan Kapllani Jr. Although Dritan has not been formally charged yet, he has moved from being an inferred "related address" on-chain to the "co-conspiracy structure" in judicial narratives.

Additionally, the same document also mentioned another involved person — Meme coin KOL yelotree, accused of assisting in money laundering through his car rental business in Miami and facing up to 30 years of imprisonment.

Turning 18, a life of indulgence comes to an end

Previously, Dritan lived a lavish lifestyle, frequently posting related content on Instagram, and interacted with other hackers through Telegram. In the hacker circle, he was once regarded as having a certain "protagonist halo" — as several related groups around him (such as ACG, 41 / RM Boyz, etc.) were gradually dealt with by law enforcement, but he himself remained unscathed.

However, as he turns 18, this "halo" also comes to an end, and his past actions began to be held legally accountable.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。