A US-based threat actor linked to at least $19 million in crypto social engineering thefts has been publicly identified by blockchain investigator ZachXBT, just days after the suspect turned 18. The exposure came alongside an unsealed federal criminal complaint, tying the individual directly to one of the largest Bitcoin thefts traced on-chain this year.
ZachXBT, posting a detailed thread on X, named Dritan Kapllani Jr as the person referred to as Co-Conspirator 1 in a complaint against Trenton Johnson unsealed May 11. Johnson faces up to 40 years in prison for his role in a 185 BTC theft that took place March 14, 2026, valued at roughly $13 million at the time.
How a Discord Call Unraveled Everything
On April 23, 2026, Kapllani joined what is known within certain online circles as a “band 4 band” on Discord, a flex-off where participants show proof of wealth. According to ZachXBT on X, Kapllani displayed $3.68M sitting in his Exodus wallet, attempting to out-show a rival threat actor.
ZachXBT wrote on X that he traced Kapllani’s Ethereum address 0x4487db847db2fc99372a985743a26f46e0b2bba6 back to the 185 BTC theft, with $5.3M flowing into the Exodus wallet the day after the crime.
By the time the Discord call happened six weeks later, $1.6 million of that had already been moved or laundered. The theft address flagged in the complaint is bc1qc07ytw5eh32khhvhtlw63kc5yfypvezru6gnue.
Kapllani had been posting luxury cars, watches, private jet access, and nightclub appearances across Instagram and Telegram, according to the same ZachXBT thread on X. None of that appeared to slow law enforcement attention — though it did accelerate ZachXBT’s.
The yelotree Connection and Laundering Route
A third individual charged in connection with the scheme is a meme coin content creator known as yelotree. Federal prosecutors say he helped move stolen funds through a Miami-based car rental business. He faces up to 30 years.
As ZachXBT noted on X, yelotree was charged specifically for his role in laundering proceeds from the theft through what appeared to be a legitimate business operation.
The criminal complaint documents, screenshots of which have circulated online, show text exchanges between Johnson and Co-Conspirator 1 celebrating after the theft. One exchange shows Co-Conspirator 1 sending messages that described the haul as being unprecedented in size, referencing the 185 BTC figure directly and saying the amount was something they were, in their words, always destined to reach.
Johnson wrote back calling the whole thing something they had really pulled off, in language that made clear both parties understood what had happened.
Six Thefts, One Wallet Trail
ZachXBT’s investigation did not stop at the March theft. A second wallet address, 0x97da0685dbba50b4cbabb0ca9e8336f4fbe41122, was posted publicly by another threat actor named John Daghita, also known as Lick, in a now-deleted Telegram message sent in retaliation after a dispute with Kapllani.
According to ZachXBT on X, that address traced back to $5.85M or more stolen across five separate high-confidence social engineering thefts dating back to August 2025.
Those theft addresses span Bitcoin and Ethereum chains, running from August through October 2025. ZachXBT said both wallets moved funds to the same laundering service within minutes of the 185 BTC theft, which he described on X as a key signal linking them to the same operator.
Daghita himself was arrested earlier this year following a separate January 2026 investigation that ZachXBT initiated after a prior band 4 band between Daghita and Kapllani exposed a $46 million theft from the US government. That investigation is documented in an earlier ZachXBT post on X.
Kapllani had reportedly avoided arrest longer than several of his known associates from groups including ACG and 41/RM Boyz, many of whom have already been taken into custody. ZachXBT, in the same thread on X, said this was likely connected to Kapllani having been a minor for most of the period covered by the investigation. He turned 18 recently.
No formal charges against Kapllani have been filed as of the time of publication.
