TLDR:
- ZachXBT traced Dritan Kapllani Jr to a 185 BTC theft linked to a March 2026 attack.
- A Discord call exposed an Exodus wallet allegedly holding millions in stolen crypto funds.
- Court filings named Dritan as a co-conspirator in the ongoing 185 BTC theft case.
- Wallet activity connected the suspect to multiple social engineering thefts during 2025.
Blockchain investigator ZachXBT has linked alleged threat actor Dritan Kapllani Jr to nearly $19 million in crypto thefts.
The accusations surfaced through a detailed thread posted on X on May 12. The investigation connected Kapllani to several social engineering attacks targeting crypto holders during 2025 and 2026.
The report also tied him to a recent 185 BTC theft and several laundering transactions linked to wallets exposed during online Discord calls and Telegram disputes.
ZachXBT Connects Dritan Kapllani Jr to 185 BTC Theft
According to ZachXBT, Dritan Kapllani Jr displayed an Exodus wallet holding $3.68 million during a Discord “band 4 band” call.
The wallet allegedly belonged to the address 0x4487db847db2fc99372a985743a26f46e0b2bba6. ZachXBT stated the call occurred on April 23, 2026.
The investigator later traced the wallet to a 185 BTC theft that occurred on March 14, 2026. The stolen Bitcoin was reportedly moved from address bc1qc07ytw5eh32khhvhtlw63kc5yfypvezru6gnue. ZachXBT claimed Dritan’s Exodus wallet received approximately $5.3 million from the theft one day later.
The thread also stated that roughly $1.6 million had already been spent or laundered before the Discord call surfaced online. ZachXBT included screenshots and wallet tracking details supporting the movement of funds between addresses.
The investigation gained more attention after a criminal complaint against Trenton Johnson became public on May 11. ZachXBT identified Johnson as one participant in the 185 BTC theft.
Court documents reportedly referenced Dritan Kapllani Jr as “Co-Conspirator 1,” although no formal charges against him have been announced.
Laundering Claims and Connections to Other Threat Actors
ZachXBT also named meme coin personality YeloTree in the thread. The investigator stated YeloTree allegedly helped launder stolen funds through a Miami rental car business. The complaint reportedly exposed additional financial activity connected to the theft operation.
The thread referenced another alleged threat actor, John Daghita, also known as “Lick.” ZachXBT previously connected Daghita to a separate $46 million theft involving US government funds earlier in 2026. Daghita was later arrested after the investigation became public.
According to ZachXBT, Daghita shared one of Dritan’s older wallet addresses in a deleted Telegram post. The address, 0x97da0685dbba50b4cbabb0ca9e8336f4fbe41122, allegedly interacted with the same laundering service connected to the 185 BTC theft.
Blockchain records reviewed by ZachXBT reportedly showed wallet transfers occurring within minutes of the March 2026 theft. The investigator wrote that the timing strengthened links between the wallet activity and the laundering operation.
Investigation Links Wallets to Multiple 2025 Crypto Thefts
ZachXBT further alleged that the older wallet traced back to more than $5.85 million stolen during five separate social engineering attacks in 2025. The thread listed several Bitcoin and Ethereum addresses connected to those incidents.
The reported thefts included incidents from August, September, and October 2025. ZachXBT categorized the cases as “high confidence” social engineering thefts targeting crypto holders. Several addresses listed in the thread allegedly received or transferred stolen assets during those operations.
The investigator also claimed Dritan Kapllani Jr maintained an active luxury lifestyle on social media platforms. Posts allegedly featured expensive vehicles, watches, clubs, and private jet travel shared across Instagram and Telegram groups.
ZachXBT stated he delayed publishing the findings until legal filings against Trenton Johnson became public. The investigator added that Dritan recently turned 18 and had avoided prosecution while many associates from groups such as ACG and 41/RM Boyz faced arrests.
