ZachXBT links 18-year-old Dritan Kapllani Jr to $19M in crypto thefts, tracing social-engineering attacks and laundering flows across wallets
Author: Akshat Thakur
May 12, 2026- Crypto investigator ZachXBT published a detailed thread accusing Dritan Kapllani Jr, a recently turned 18-year-old US-based threat actor, of being tied to roughly $19 million in crypto thefts linked to social-engineering attacks.
High Signal Summary For A Quick Glance
Noah
@NoahWeb3_
@zachxbt That might be the ugliest watch money can buy
1/ Meet Dritan Kapllani Jr, a US based threat actor tied to $19M from social engineering thefts targeting crypto holders. Dritan flexes luxury cars, watches, private jets, & clubs all over social media. Recently he was recorded on a call showing off a wallet with stolen funds. https://t.co/iDKyUjUm4M
12:07 PM·May 12, 2026
Specter
@SpecterAnalyst
@zachxbt Another john… these guys can never stop going band for band. When you make money through crime, staying low-profile becomes impossible. Eventually, the exposure catches up with you and then comes the arrest, just like Lick. Great job as always, ser.
1/ Meet Dritan Kapllani Jr, a US based threat actor tied to $19M from social engineering thefts targeting crypto holders. Dritan flexes luxury cars, watches, private jets, & clubs all over social media. Recently he was recorded on a call showing off a wallet with stolen funds. https://t.co/iDKyUjUm4M
12:06 PM·May 12, 2026
M9
@CryptoSammy19
@zachxbt How do these seemingly retarded fucktards pull off social engineering?
1/ Meet Dritan Kapllani Jr, a US based threat actor tied to $19M from social engineering thefts targeting crypto holders. Dritan flexes luxury cars, watches, private jets, & clubs all over social media. Recently he was recorded on a call showing off a wallet with stolen funds. https://t.co/iDKyUjUm4M
12:03 PM·May 12, 2026
High attention and emotional sentiment detected.
According to ZachXBT, Dritan Kapllani Jr, a US-based individual, carried out multiple social-engineering attacks targeting crypto holders between 2025 and 2026. According to the investigation, Dritan allegedly received and laundered proceeds from multiple thefts while publicly flaunting luxury cars, watches, private jets, and nightlife across social media platforms.
The thread claims Dritan publicly displayed luxury purchases and expensive lifestyles online while allegedly laundering stolen funds through crypto wallets and other channels.
ZachXBT also stated that Dritan recently turned 18, adding that “hopefully now his borrowed time is finally up.”
The investigation links Dritan to wallet activity connected to both Bitcoin and Ethereum-based theft proceeds. “Meet Dritan Kapllani Jr, a US based threat actor tied to $19M from social engineering thefts targeting crypto holders,” ZachXBT wrote in the opening post.
The largest incident tied to the investigation occurred on March 14, 2026.
According to ZachXBT, attackers stole 185 BTC worth roughly $13 million at the time. The stolen funds later flowed through wallets allegedly connected to Dritan.
The investigation states that Dritan’s Exodus wallet received approximately $5.3 million from the theft on March 15. ZachXBT also tied Dritan to five additional high-confidence social-engineering thefts during August, September, and October 2025.
Combined, those earlier incidents allegedly totaled more than $5.85 million. The older wallet connected to the investigation reportedly moved funds into a laundering service shortly after the 185 BTC theft occurred.
Key milestones in ZachXBT’s Dritan Kapllani Jr. Investigation
Multiple high-confidence thefts totaling more than $5.85M are linked on-chain to wallets associated with Dritan Kapllani Jr.
ZachXBT investigates John Daghita in another major theft case, leading to leaked Telegram references connected to Dritan’s wallet activity.
The largest known theft in the investigation occurs, with approximately 185 BTC stolen through a social-engineering attack.
Millions in stolen proceeds are traced into Dritan’s primary Exodus wallet before being moved into laundering infrastructure.
Dritan allegedly appears on a Band 4 Band Discord call displaying millions in stolen crypto while discussing exploits with other threat actors.
U.S. authorities unseal charges against Trenton Johnson tied to the March BTC theft, with Dritan identified as Co-Conspirator 1.
The complete investigative thread goes public, detailing more than $19M in linked thefts, laundering flows, and social-media evidence.
Dritan Kapllani Jr. has not yet been formally charged, while on-chain tracing and federal investigations continue.
One of the most widely shared details from the thread involved a Discord “Band 4 Band” call recorded on April 23, 2026. According to ZachXBT, Dritan joined the call and displayed an Exodus wallet containing approximately $3.68 million in stolen funds.
The investigator claimed the display happened during an argument between threat actors attempting to out-flex each other financially. The moment quickly became a major talking point across crypto social media because it allegedly showed direct access to funds linked to the thefts.
The investigation describes the attacks as social-engineering operations rather than technical hacks. According to ZachXBT, attackers used insider information or private databases to gather sensitive details about victims.
Those details were allegedly used to impersonate trusted parties, manipulate targets, or gain wallet access through deception. Social-engineering attacks remain one of crypto’s biggest security threats because they exploit human behavior instead of smart contract vulnerabilities.
Once funds are stolen, attackers typically move assets through multiple wallets, laundering services, OTC desks, or front businesses to obscure the transaction trail.
The investigation also connects the case to a criminal complaint unsealed on May 11, 2026.
The complaint reportedly targets Trenton Johnson for involvement in the 185 BTC theft.
According to ZachXBT, Dritan appears in the filing as “Co-Conspirator 1,” although no public charges against him have been announced yet.
The thread also references @yelotree, described as a meme-coin KOL allegedly tied to laundering activity connected to the stolen funds.
Another figure connected to the timeline is John Daghita, who was previously accused of stealing $46 million from the US government earlier this year.
ZachXBT stated Daghita exposed Dritan’s older wallet during a fallout between threat actors.
The case highlights how social-engineering attacks continue bypassing even technically secure crypto systems.
Unlike smart contract exploits, these operations target people directly through manipulation, impersonation, or stolen personal information.
The investigation also demonstrates how public blockchain data allows on-chain analysts to trace laundering flows over time.
ZachXBT has built a reputation for assisting law enforcement and exposing crypto criminals through wallet analysis, behavioral tracking, and cross-platform evidence gathering.
The public nature of the allegations could increase pressure for arrests, prosecutions, or additional investigations tied to connected wallets and accomplices.
As of May 12, 2026, Dritan Kapllani Jr has not publicly responded to the allegations. No public arrest or formal charges against him have been announced so far.
However, the release of the criminal complaint and growing public attention could increase pressure on investigators and federal authorities to expand the case further.
The investigation may also lead to additional wallet tracking, identification of co-conspirators, or asset seizure efforts tied to the laundering flows.
For the broader crypto industry, the case serves as another reminder that social engineering remains one of the most dangerous attack vectors for digital asset holders.
This article is for informational purposes only and does not constitute financial advice. Always do your own research before making investment decisions.
Our Crypto Talk is committed to unbiased, transparent, and true reporting to the best of our knowledge. This news article aims to provide accurate information in a timely manner. However, we advise the readers to verify facts independently and consult a professional before making any decisions based on the content since our sources could be wrong too. Check our Terms and conditions for more info.
Polymarket Hack Drains $3M in PUSD via Frontend Exploit
SecondFi Wallet Exploit Drains 16 Million ADA From Users
Jaredfromsubway Exploit Funds Move To Tornado Cash Despite 50% Bounty
Taiko Bridge Exploit Drains $1.7M Through SGX Key Exposure
Polymarket Hack Drains $3M in PUSD via Frontend Exploit
SecondFi Wallet Exploit Drains 16 Million ADA From Users
Jaredfromsubway Exploit Funds Move To Tornado Cash Despite 50% Bounty
Taiko Bridge Exploit Drains $1.7M Through SGX Key Exposure
