18歲黑客在Discord炫富，意外牽出1900萬美元盜竊案
- 核心觀點：鏈上偵探 ZachXBT 透過一場 Discord 炫富語音通話，追蹤到一名 18 歲美國黑客 Dritan Kapllani Jr. 涉嫌參與多起社會工程攻擊，涉案金額約 1900 萬美元，其鏈上地址已被美國司法文件列為「共謀者」。
- 關鍵要素：
- 2026年4月，黑客 Dritan 在 Discord 語音通話中展示其 Exodus 錢包餘額約 368 萬美元，此舉成為 ZachXBT 調查的突破口。
- 2026年3月，185 枚比特幣（約1300萬美元）被盜，其中約530萬美元於次日轉入 Dritan 展示的錢包地址。
- 鏈上分析顯示，Dritan 的錢包還接收了來自 2025 年多起盜竊案、總金額超 585 萬美元的資金，路徑高度相似。
- Dritan 曾與黑客 Lick（因竊取約4600萬美元美國政府資金被捕）爭執，Lick 事後曝光了 Dritan 的舊地址，該地址資金流向與展示錢包一致。
- 2026年5月，針對185枚比特幣盜竊案的起訴書中，將 Dritan 標記為「共謀者1號（CC-1）」，雖未被正式起訴，但已進入司法敘事。
- Dritan 長期過奢靡生活並在社交平台炫耀，但剛滿18歲即被追責，此前關聯團體（如ACG、41/RM Boyz）已被執法機關處理。
Original | Odaily Planet Daily (@OdailyChina)
Author | Asher (@Asher_ 0210)
Last night, on-chain detective ZachXBT posted an exposé about an 18-year-old hacker from the United States named Dritan Kapllani Jr. According to disclosed information, this young man, Dritan Kapllani Jr., is suspected of being involved in multiple social engineering attacks targeting crypto users, with total cumulative losses amounting to approximately $19 million. Although he has not yet been formally charged, he has been classified as a "co-conspirator" in US judicial documents.
The case quickly drew attention, not only due to the enormous sum involved but also because of its dramatic starting point—a voice call intended for showing off wealth became the breakthrough in the entire investigation.
Just a Flash of Wealth on Discord
On April 23, 2026, a dispute in a Discord voice channel set the stage for this incident.
It was a voice call dubbed "Band 4 Band," where participants compared their "status" in the most direct way—by displaying their respective assets. The atmosphere quickly shifted from banter to competition. Driven by this competitive spirit, Dritan, in an effort to prove he was richer, directly shared his screen, showing his Exodus wallet interface with a balance of approximately $3.68 million.
A few weeks later, this screenshot was brought back into focus. On-chain detective ZachXBT started from this address, linking fragmented transactions one by one, gradually revealing a longer trail of funds.
The Emergence of a Stolen Fund of 185 Bitcoins
Going back to March 14, 2026, a social engineering theft involving 185 Bitcoins occurred, valued at approximately $13 million at the time. The funds were transferred from their original addresses within a short period and quickly entered an on-chain obfuscation system.
Just the next day, approximately $5.3 million was transferred into the wallet Dritan had shown during the Discord voice call (address: 0x4487db847db2fc99372a985743a26f46e0b2bba6). Over the following weeks, this $5.3 million was repeatedly split, transferred through multiple addresses, and sent to various destinations. By the time of the voice call on April 23, about $1.6 million had already been moved further.
This Wasn't His First Crypto Theft
Tracing backwards from the wallet address Dritan displayed, it was quickly discovered that the funds within did not solely originate from the theft of 185 Bitcoins.
According to on-chain analysis, the source of funds for this wallet can be traced back to multiple social engineering thefts from 2025, totaling over $5.85 million. Different victims, different times, but the method was remarkably similar: once stolen, the funds were rapidly split, transferred through a chain of addresses, and moved along a very consistent path. By tracing these funds piece by piece, it becomes clear that many transactions ultimately funneled into the wallet address that Dritan had shown.
Notably, Dritan once had a "Band 4 Band" dispute with hacker John Daghita (Lick). Lick was later arrested for allegedly stealing approximately $46 million in US government funds. In a since-deleted Telegram post, Lick had also publicly revealed this old address of Dritan's (address: 0x97da0685dbba50b4cbabb0ca9e8336f4fbe41122), which now appears to have been an act of retaliation.
In terms of on-chain behavior, the fund splitting methods, transfer paths, and subsequent flows of this old address are highly consistent with the wallet address Dritan displayed, leading investigators to believe they were controlled by the same entity.
First "Naming" in Judicial Documents
It wasn't until May 11, 2026, that this on-chain fund trail was formally acknowledged in judicial documents. On that day, the criminal indictment against Trenton Johnson was unsealed. For his involvement in the theft of 185 Bitcoins, he has been charged and faces up to 40 years in prison.
In the indictment, a key co-conspirator is labeled "Co-Conspirator 1 (CC-1)," and the on-chain analysis community has identified this individual as Dritan Kapllani Jr. Although Dritan has not yet been formally charged, he has moved from being a "linked address" inferred on-chain to being part of the "conspiracy structure" within the judicial narrative.
Furthermore, the same document mentions another individual involved—Meme coin KOL yelotree—who has been charged with aiding in money laundering through his car rental business in Miami and faces up to 30 years in prison.
Turned 18, the Decadent Life Comes to an End
Previously, Dritan had lived a long period of extravagant life, frequently posting content on Instagram and interacting with other hackers on Telegram. Within hacker circles, he was once thought to possess a sort of "protagonist halo"—with multiple associated groups around him (such as ACG, 41/RM Boyz, etc.) being dealt with by law enforcement one after another, while he himself remained untouched.
However, as he turned 18, this "halo" also faded, and he began to face legal accountability for his past actions.
