NewsFlash Articles Data Fundraising Skill&API

An 18-Year-Old Hacker Brags on Discord, Accidentally Unveils $19 Million Theft

ODAILY星球日报

Read this article in 8 Minutes

Hacker Showdown: Accidentally Doxxed to On-Chain Sleuth ZachXBT's Radar

Original Title: "18-Year-Old Hacker Flaunts Wealth on Discord, Accidentally Unveils $19 Million Theft Case"
Original Author: Asher, Odaily Planet Daily

Last night, on-chain detective ZachXBT revealed a young 18-year-old hacker named Dritan Kapllani Jr. from the United States. According to the information disclosed, this young individual named Dritan Kapllani Jr. is alleged to have been involved in multiple social engineering attacks targeting cryptocurrency users, with a total amount involved of approximately $19 million.

Although he has not yet been formally charged, he has already been included in the U.S. judicial documents as a "co-conspirator."

This case quickly drew attention not only because of the significant amount involved but also because of the highly dramatic starting point—what was originally a flaunting of wealth in a voice call became the breakthrough in the entire investigation.

Just One Instance of Flaunting Wealth on Discord

On April 23, 2026, a dispute that took place in a Discord voice channel set the stage for this incident.

It was a voice call called "Band 4 Band," where participants compared their "strength" in the most direct way—by displaying the assets they held. The atmosphere quickly shifted from banter to competition, and in this emotionally driven setting, Dritan, to prove he was wealthier, directly started screen sharing, revealing his Exodus wallet interface showing a balance of around $3.68 million.

However, weeks later, this screenshot was brought back into focus. On-chain detective ZachXBT traced from this address, linking the previously scattered transactions one by one, gradually revealing a longer money trail.

A 185 BTC Theft Fund Emerges

Fast forward to March 14, 2026, a social engineering theft involving 185 bitcoins occurred, valued at around $13 million at the time. The funds were quickly moved out of the original address and entered the on-chain mixing system.

Just the next day, approximately $5.3 million of it was transferred to the wallet Dritan had displayed during the Discord voice call (address: 0x4487db847db2fc99372a985743a26f46e0b2bba6).

In the following weeks, this approximately $5.3 million fund was continuously split, transferred through multiple addresses, and sent to various destinations. By the time of the voice call on April 23, about $1.6 million had been further transferred.

This is not the first time engaging in crypto theft

Tracing back along the wallet address showcased by Dritan, it was quickly discovered that the funds in it did not only come from the 185 BTC theft.

According to on-chain analysis, the funds in this wallet can be traced back to multiple instances of social engineering thefts dating back to 2025, totaling over $5.85 million. Different victims, different times, but after the funds are moved, they are promptly split, then further transferred through a series of addresses following a very similar pattern. When these transactions are traced individually, it is found that many transfers ultimately end up at the wallet address showcased by Dritan.

It is worth noting that Dritan had a "Band 4 Band" dispute with the hacker John Daghita (Lick) in the past.

Lick was later arrested for allegedly stealing around $46 million of U.S. government funds, and in a subsequently deleted Telegram post, he had publicly shared Dritan's old address (Address: 0x97da0685dbba50b4cbabb0ca9e8336f4fbe41122), which at the moment appears more like an act of revenge.

From on-chain behavior, the old address has shown a highly consistent fund-splitting method, transfer path, and subsequent flow as the funds in the wallet showcased by Dritan, hence believed to be controlled by the same entity.

Legal Document First-Ever "Call-Out"

It was not until May 11, 2026, that this on-chain fund path was formally acknowledged in a legal document for the first time. On that day, the criminal indictment against Trenton Johnson was unsealed. He was charged and faced up to 40 years in prison for his involvement in the 185 BTC theft case.

In the indictment, a key conspirator was labeled as "Co-Conspirator 1 (CC-1)," and the on-chain analysis community has already linked this identity to Dritan Kapllani Jr. Although Dritan has not been formally indicted at present, he has transitioned from the "associated address" in on-chain inferences to the "conspiracy structure" in the judicial narrative.

Furthermore, the same document also mentioned another individual involved—Meme Coin KOL yelotree, who is accused of assisting in money laundering through his car rental business in Miami and is facing up to 30 years in prison.

Coming of Age at 18, the End of a Decadent Lifestyle

Prior to this, Dritan had long lived a lavish lifestyle, frequently posting related content on Instagram and engaging with other hackers via Telegram. Within the hacker community, he was once thought to have a kind of "protagonist halo"—several associated groups around him (such as ACG, 41/RM Boyz, etc.) were successively dealt with by law enforcement, but he himself remained untouched.

However, as he turned 18, this "halo" also came to an end, and his past actions began to be legally pursued.