Community Trust ScoreLikely Real
Blockchain sleuth ZachXBT just dropped a bombshell report connecting a US teenager to more than $19 million in stolen crypto. The kid’s name: Dritan Kapllani Jr.
And he wasn’t exactly keeping a low profile. Dritan spent months posting pictures of luxury cars, expensive watches, private jets, and bottle service across his social media feeds while chatting with other hackers online. The whole thing came to a head during an April 23, 2026, Discord call where Dritan allegedly opened up an Exodus wallet packed with $3.68 million in cryptocurrency—basically showing off during what hackers call a “band 4 band” challenge. That’s when people compare how much money they’ve got.
ZachXBT dug deeper. He traced Dritan’s Ethereum wallet back to a massive Bitcoin heist that went down on March 14, 2026. Someone lifted 185 BTC through social engineering tricks, worth around $13 million at the time. Dritan’s wallet got $5.3 million from that theft by March 15, according to the investigator. By the time of the Discord call a month later, $1.6 million had already vanished—either spent or laundered through the system.
Federal Case Names Teen as Co-Conspirator
US authorities unsealed a criminal complaint against Trenton Johnson for his role in the 185 BTC theft. The documents name Dritan as “Co-Conspirator 1.” But here’s the thing: no charges against Dritan yet. He was a minor when most of this stuff happened. Just turned 18 recently.
ZachXBT held back his findings until the Johnson charges became public. He wanted the official legal process to move first. Smart move, probably.
The investigator also connected Dritan to an earlier case involving John Daghita, who goes by “Lick” online. Daghita got accused of stealing $46 million from the US government back in January 2026. ZachXBT found one of Dritan’s wallet addresses in a deleted Telegram post that Daghita had shared. That same wallet address showed up in at least five other social engineering thefts during 2025, grabbing over $5.85 million total.
Meme Coin Influencer Helped Launder Funds
The network gets messier. ZachXBT’s report links Dritan to a meme coin influencer called “yelotree.” Turns out yelotree allegedly helped wash some of the stolen money through a rental car business in Miami. Not your typical crypto laundering setup, but it worked for a while.
Social engineering played a huge role in these thefts. Dritan and his crew didn’t hack systems with code—they manipulated people. Tricked them into handing over access to their wallets. It’s an old con dressed up in new technology. And it’s pretty effective when victims don’t see it coming.
The Discord call where Dritan flashed his wallet balance wasn’t just bragging. It gave ZachXBT a direct link between the person and the funds. Hackers love showing off online, and that’s often what gets them caught. One screenshot, one boastful moment, and suddenly investigators have a thread to pull.
ZachXBT’s ability to trace funds across multiple wallets and platforms shows how transparent blockchain can be—if you know what you’re looking for. Every transaction leaves a record. Dritan’s wallet moved money around, but those movements created a map. The investigator followed it step by step, connecting thefts from 2025 to the big Bitcoin job in March 2026.
The rental car business angle is wild. Using a legitimate business to clean dirty crypto isn’t new, but it’s risky. Cash-heavy businesses have always been popular for laundering, and apparently that extends to crypto now. Yelotree’s involvement adds another layer to the investigation. More people means more potential charges down the line.
Dritan’s age complicated things legally. Prosecutors can’t treat a 17-year-old the same way they’d treat an adult, even if the crimes are identical. But now that he’s 18, the clock starts ticking differently. Authorities can pursue charges without the restrictions that come with juvenile cases.
The Johnson complaint gives us a peek at how federal prosecutors are building their case. Naming Dritan as a co-conspirator without charging him yet means they’re still gathering evidence. Or maybe they’re waiting to see if he cooperates. Either way, the legal pressure is mounting.
ZachXBT’s investigation took months. He didn’t rush to publish. Waited for the right moment when official charges gave him cover. That’s smart journalism and smart investigation work. Going public too early can mess up active cases.
The $46 million government theft that Daghita got linked to is a separate beast, but the connections matter. If Dritan worked with Daghita, that opens up questions about other jobs they might’ve pulled together. Federal investigators probably have a whole chart mapping out who worked with whom and when.
Five separate social engineering thefts in 2025 totaling $5.85 million—that’s a pattern. Not one-off crimes. A sustained operation targeting crypto holders over months. Each victim got played differently, but the wallet addresses tied them all back to the same group.
The luxury lifestyle posts weren’t just vanity. They were part of the hacker culture. Showing off proves you’re successful in that world. But it also creates evidence. Every Instagram story, every Snapchat of a Rolex, every private jet selfie becomes part of the digital trail.
Discord calls are supposed to be private, but nothing’s really private when people take screenshots. That April 23 call gave investigators a timestamp, a dollar amount, and a direct connection between Dritan and the stolen funds. One moment of showing off, preserved forever.
The Bitcoin theft on March 14 was huge—185 BTC is serious money. And the speed of the laundering operation was impressive. Within 24 hours, $5.3 million had moved into Dritan’s wallet. By early April, $1.6 million had already been spent or moved again. These guys worked fast.
But fast doesn’t mean careful. The trail ZachXBT uncovered shows plenty of mistakes. Using the same wallet addresses across multiple thefts. Posting about wealth online. Connecting with known criminals on public platforms. Each mistake made the investigator’s job easier.
The case is still developing. More charges could come. More connections might surface. The network ZachXBT mapped out probably extends beyond what’s public right now. Federal investigators tend to build cases from the bottom up, flipping smaller players to get the bigger fish.
Dritan’s recent 18th birthday changes everything legally. Prosecutors can now file adult charges without worrying about juvenile court restrictions. The timing works out for authorities—they’ve got evidence, they’ve got connections, and now they’ve got a defendant who can face the full weight of federal law.
Frequently Asked Questions
What exactly did Dritan Kapllani Jr. allegedly do?
ZachXBT connected him to over $19 million in cryptocurrency thefts through social engineering attacks, including a 185 BTC heist worth $13 million in March 2026.
Why hasn’t Dritan been charged yet?
He was a minor during most of the alleged crimes and only recently turned 18, which complicated prosecution until now.
How did ZachXBT track the stolen funds?
He traced wallet addresses across multiple transactions and connected them to Dritan through a Discord call where the teen displayed $3.68 million in an Exodus wallet.
