18-year-old hacker flaunts wealth on Discord, inadvertently exposing a $19 million theft

Original by Odaily Planet Daily (@OdailyChina)

Author: Asher (@Asher_ 0210)

Last night, on-chain detective ZachXBT exposed an 18-year-old hacker from the United States named Dritan Kapllani Jr. According to the disclosed information, this young man, Dritan Kapllani Jr., is suspected of being involved in multiple social engineering attacks targeting crypto users, with a total involved amount of approximately $19 million. Although he has not yet been formally indicted, he has been included as a "co-conspirator" in US judicial documents.

The case quickly garnered attention not just because of the staggering amount involved, but also because of the dramatic starting point—a voice call intended for showing off became the breakthrough for the entire investigation.

Just a Single Display of Wealth on Discord

On April 23, 2026, a heated argument in a Discord voice channel kicked off the incident.

It was a voice call dubbed "Band 4 Band," where participants compared their "strength" in the most direct way—by showing off their respective holdings. The atmosphere quickly shifted from banter to rivalry. Driven by this competitive spirit, Dritan, eager to prove he was wealthier, directly shared his screen, revealing his Exodus wallet interface showing a balance of approximately $3.68 million.

Several weeks later, this screenshot was brought to light again. On-chain detective ZachXBT started from this address, piecing together scattered transactions one by one, gradually revealing a longer trail of funds.

Funds from a Theft of 185 Bitcoins Come to Light

Traveling back to March 14, 2026, a social engineering theft involving 185 Bitcoins occurred, valued at approximately $13 million at the time. The funds were moved out of the original address within a short period and quickly entered an on-chain distribution system.

Just the next day, approximately $5.3 million of it was transferred into the wallet address Dritan had shown during the Discord voice call (address: 0x4487db847db2fc99372a985743a26f46e0b2bba6). Over the following weeks, this sum of about $5.3 million was continuously split, transferred through multiple addresses, and funneled to various destinations. By the time of the voice call on April 23, approximately $1.6 million had been further transferred.

Not His First Time Involved in Crypto Theft

Tracing back from the wallet address Dritan showed, it was quickly discovered that the funds within it originated from more than just the theft of those 185 Bitcoins.

According to on-chain analysis, the source of funds for this wallet can be traced back to multiple social engineering thefts occurring in 2025, totaling over $5.85 million. Different victims, different times, but after being stolen, the funds were consistently split rapidly, then transferred through a series of addresses, following a very similar pattern. By matching these funds piece by piece, it becomes apparent that many transfers ultimately ended up in the wallet address Dritan had shown.

Notably, Dritan had once been in a "Band 4 Band" dispute with hacker John Daghita (Lick). Lick was later arrested for allegedly stealing approximately $46 million in US government funds. In a subsequently deleted Telegram post, Lick had also publicly revealed this old address of Dritan's (address: 0x97da0685dbba50b4cbabb0ca9e8336f4fbe41122), an act now seen more as an act of retaliation.

Based on on-chain behavior, the fund splitting methods, transfer paths, and subsequent flow from this old address are highly consistent with the fund flows in the wallet Dritan showed. Therefore, it is believed to be controlled by the same party.

Judicial Documents "Name" Him for the First Time

It wasn't until May 11, 2026, that this on-chain fund trail was officially confirmed in judicial documents. On that day, the criminal indictment against Trenton Johnson was unsealed. For his involvement in the theft of the 185 Bitcoins, he was charged and faces a maximum of 40 years in prison.

In the indictment, a key co-conspirator is labeled "Co-Conspirator 1 (CC-1)," and the on-chain analysis community has identified this individual as Dritan Kapllani Jr. Although Dritan has not yet been formally indicted, he has transitioned from being a "linked address" inferred on-chain to being part of the "conspiracy structure" within the judicial narrative.

Furthermore, the same document mentions another individual involved—Meme coin KOL yelotree—who is accused of aiding money laundering through his car rental business in Miami and faces a maximum sentence of 30 years.

Turning 18, a Decadent Lifestyle Comes to an End

Previously, Dritan had long led a lavish lifestyle, frequently posting related content on Instagram and interacting with other hackers via Telegram. Within hacker circles, he was once regarded as having a certain "protagonist aura"—multiple associated groups around him (such as ACG, 41/RM Boyz, etc.) were successively taken down by law enforcement, while he himself remained untouched.

However, as he turned 18, this "aura" also ended, and his past actions began to face legal consequences.