ZachXBT exposes alleged 18-year-old crypto thief tied to $19 million in scams

On Tuesday, on-chain sleuth ZachXBT named Dritan Kapllani Jr. as the US-based alleged scammer linked to about $19 million (185 BTC) taken from crypto holders through social engineering.

According to Zach, Dritan has been showing off cars, watches, private jets, and club trips online, while blockchain trails allegedly connected him to stolen funds.

On an April 23 Discord call, Zach said Dritan joined a band-for-band contest, where scammers were boldly comparing money on screen.

During the call, Dritan allegedly showed $3.68 million inside an Exodus wallet to prove he had deeper pockets than another scammer. Zach listed Dritan’s Ethereum wallet as 0x4487db847db2fc99372a985743a26f46e0b2bba6 and gave his Discord ID as 1485730459483902103.

Zach links Dritan’s wallet to the 185 BTC theft and the Trenton Johnson case

Zach explained that the Ethereum wallet that ends with the number 0x4487 was involved in the theft of 185 BTC, which had a value of about $13 million on March 14. The Bitcoin wallet that was involved in the robbery is bc1qc07ytw5eh32khhvhtlw63kc5yfypvezru6gnue.

On March 15, Dritan received $5.3 million via his Exodus wallet from the stolen money. By the time there was the Discord discussion six weeks after the event, Zach mentioned that about $1.6 million had been withdrawn from it.

A criminal complaint against Trenton Johnson was unsealed on May 11 over the same 185 BTC theft. Trenton faces up to 40 years in prison. Zach said the complaint’s Co-Conspirator 1, listed as CC-1, is Dritan, though Dritan has not been charged.

Yelo, the meme coin KOL known as @yelotree, was also charged. Prosecutors accused Yelo of helping wash funds through his Miami rental car business. Yelo faces up to 30 years.

Dritan’s name also came up through John Daghita, known as Lick. Zach said Dritan once did another band-for-band with John, which led to Zach’s January 2026 investigation into John’s alleged $46 million theft from the US government. John was later arrested.

After that, John posted one of Dritan’s older wallet addresses in a deleted Telegram post: 0x97da0685dbba50b4cbabb0ca9e8336f4fbe41122. Zach said the address matched his own review because Dritan sent funds to the same laundering service within minutes of the 185 BTC theft.

That older wallet allegedly led to more than $5.85 million across five other high-confidence social engineering thefts in 2025. Zach listed three October Bitcoin addresses: bc1qfv64ltd7fzfr9h6wcn540wv2jpadm6zswnj90w, bc1qsh43dxcze5vfdf5utqv2qyp86epz9xjweuvqj6, and bc1qtzwzn9r6a0d32mcva7txvsden8srm05gaxpz5z.

He also named a September address, bc1qky6zk8fkuwg5a7nr9923ts4k3ftjj2nmvrknnx, and an August Ethereum address, 0xea9fccb3ea820f080f38e9c49fc1a201066010c7.

Authorities arrest 276 suspects as Meta helps trace scam-center accounts

Additionally, Zach claimed that Dritan always showed off his luxurious life on Instagram and even used the same picture with suspected actors of threats in Telegram. He said that he helped one of the affected people by researching Trenton’s and Dritan’s on-chain activity. However, Zach decided not to publish it until Dritan was officially charged.

Moreover, Zach highlighted that Dritan has “tons of plot armor” because many people around him from such organizations as ACG and 41/RM Boyz were arrested for their illegal actions, but he managed to avoid being prosecuted.

As far as it concerns, Dritan was a minor recently, and it can be explained by the fact that law enforcement tends to postpone official charges for minors.

However, a large-scale crackdown on cryptocurrency scams organized by the Department of Justice and the Federal Bureau of Investigation took place on Friday, resulting in 276 arrests and the closure of at least nine scam centers linked to cryptocurrency scams.

U.S. government agencies and several technology companies, along with Dubai Police, Thai authorities, and representatives from other countries, participated in the investigation. The suspects now face federal wire fraud and money laundering charges.

According to investigators, scam centers functioned as companies and employed recruiters, managers, and special mechanisms for deceiving potential victims. The majority of scams used pig-butchering.

Scam centers usually used attractive-looking platforms with fictitious profits, and sometimes victims borrowed money for investments which then vanished.

On its part, Meta Platforms, Inc. (META) provided substantial assistance to the authorities during the investigation and reported the removal of more than 159 million scam ads in 2025 and the blocking of 10.9 million user accounts linked to scam centers.

If you're reading this, you’re already ahead. Stay there with our newsletter.