18-year-old hacker flaunts wealth on Discord, accidentally exposing a $19 million theft case

Original by Odaily (@OdailyChina)

Author: Asher (@Asher_0210)

Last night, on-chain detective ZachXBT exposed an 18-year-old hacker from the United States named Dritan Kapllani Jr. According to the disclosed information, this young man, Dritan Kapllani Jr., is suspected of involvement in multiple social engineering attacks targeting crypto users, with cumulative damages amounting to approximately $19 million. Although he has not been formally charged yet, he has already been included within the scope of "co-conspirators" in U.S. judicial documents.

This case quickly attracted attention, not only because of the enormous sum involved, but also because its starting point was highly dramatic — a voice call meant to show off wealth became the breakthrough in the entire investigation.

Just Showing Off Once on Discord

On April 23, 2026, an argument in a Discord voice channel set the stage for this incident.

It was a voice call known as "Band 4 Band," where participants compare their "strength" in the most direct way — by showing off their respective assets. The atmosphere quickly shifted from banter to rivalry. Driven by this competitive spirit, Dritan, to prove he was wealthier, directly shared his screen, displaying his Exodus wallet interface with a balance of approximately $3.68 million.

A few weeks later, this screenshot was brought back into the spotlight. Starting from this address, on-chain detective ZachXBT pieced together disparate transactions one by one, and a longer trail of funds gradually emerged.

Funds from a Theft of 185 Bitcoin Surface

Going back to March 14, 2026, a social engineering theft involving 185 Bitcoin occurred, valued at approximately $13 million at the time. The funds were moved out of the original address within a short period and quickly entered an on-chain laundering process.

Just the next day, approximately $5.3 million of this was transferred to the wallet address Dritan had shown during the Discord voice call (address: 0x4487db847db2fc99372a985743a26f46e0b2bba6). Over the following weeks, this sum of roughly $5.3 million was continuously split, transferred through multiple addresses, and moved to various locations. By the time the voice conversation on April 23 occurred, approximately $1.6 million had already been further transferred.

Not the First Participation in Crypto Theft

Investigating backwards from the wallet address Dritan revealed, it was quickly discovered that the funds in it did not solely originate from the 185 Bitcoin theft.

According to on-chain analysis, the funding sources for this wallet can be traced back to multiple social engineering thefts in 2025, totaling over $5.85 million. Different victims, different times, but after being transferred out, the funds were consistently split quickly and then continued moving through a series of addresses, following a very similar pattern. When these funds are pieced together, it becomes apparent that many transfers ultimately lead back to the wallet address Dritan displayed.

It is worth noting that Dritan once had a "Band 4 Band" argument with hacker John Daghita (Lick). Lick was later arrested for allegedly stealing approximately $46 million in U.S. government funds. In a subsequently deleted Telegram post, Lick had publicly revealed this old address of Dritan (address: 0x97da0685dbba50b4cbabb0ca9e8336f4fbe41122), an act now viewed more as an act of revenge.

From an on-chain behavior perspective, this old address's method of splitting funds, transfer paths, and subsequent flow show a high degree of consistency with the wallet funds Dritan displayed, leading to the conclusion they were used by the same controlling entity.

Judicial Documents "Name" for the First Time

It wasn't until May 11, 2026, that this on-chain fund trail was formally acknowledged in judicial documents. On that day, the criminal indictment against Trenton Johnson was unsealed. He was charged for his involvement in the 185 Bitcoin theft and faces up to 40 years in prison.

In the indictment, a key co-conspirator is marked as "Co-Conspirator 1 (CC-1)," and the on-chain analysis community has identified this individual as Dritan Kapllani Jr. Although Dritan has not yet been formally indicted, he has transitioned from a "linked address" deduced on-chain to being part of the "co-conspirator structure" within the judicial narrative.

Additionally, the same document mentions another individual involved — Meme coin KOL yelotree, who is accused of assisting in money laundering through his car rental business in Miami and faces up to 30 years in prison.

Turning 18, the Dissolute Life Comes to an End

Previously, Dritan led a lavish lifestyle for an extended period, frequently posting related content on Instagram and interacting with other hackers via Telegram. Within hacker circles, he was once considered to possess a certain "plot armor" — multiple affiliated groups around him (such as ACG, 41 / RM Boyz, etc.) were progressively targeted by law enforcement, while he personally remained unaffected.

However, as he turned 18, this "plot armor" ended, and past behaviors began to incur legal consequences.