Dritan Kapllani: The Teen ZachXBT Ties to $19M in Crypto Thefts

On 13 March 2026 a bitcoin holder in California answered a call from someone who said they worked for Google. A second call came from someone claiming to be from Trezor, the company that makes small USB-sized hardware wallets used to lock away cryptocurrency. By the early hours of 14 March, 185 bitcoin had left the victim's wallets. At the time they were worth about $13 million. None of it has been recovered.

Six weeks later, on 23 April, a young man on a Discord voice call opened a crypto wallet app and shared his screen. It was a "band for band", a contest in which two people show their balances to see who has more money. His Exodus wallet, a popular app for holding coins on a phone or computer, showed about $3.68 million. The call was recorded.

The man on screen, according to the blockchain investigator known as ZachXBT, was Dritan Kapllani Jr., a US-based 18-year-old whose social media was full of supercars, watches, private jets and nightclubs. On 12 May 2026 ZachXBT published a thread tying Kapllani to about $19 million in thefts. Kapllani has not been charged with any crime.

How the theft worked

There was no hack in the usual sense. The method is called social engineering: tricking a person into handing over access, rather than breaking into a computer. Callers pose as support staff, warn the victim that an account is under attack, and talk them into "securing" it, which in practice means giving the callers control. It is the same trick as a fake bank fraud department, applied to crypto.

Crypto makes the trick final. Coins are controlled by whoever holds the private key, a secret code that works like the only key to a safe deposit box. Once coins are moved there is no bank to reverse the payment.

According to US prosecutors, the crew posed as support representatives from "a popular search engine" and from crypto companies, took over victims' accounts and wallets, and moved the money to themselves. The 185 bitcoin were split across new addresses within about 90 minutes, ZachXBT reported, then swapped into ether, the currency of the Ethereum network, and spread through more wallets.

The two men who were charged

The court case does not carry Kapllani's name in its caption. On 11 May 2026 the US Attorney's Office for the Southern District of Florida announced an indictment of Trenton Richard David Johnston, a Canadian then aged 19, and Brandon Michael Tardibone, 28, of Miami. Early crypto coverage, including ZachXBT's thread, spelled the first name as Trenton Johnson.

Prosecutors said Johnston had overstayed his visa and was running the scheme from the Miami area, and that victims' losses exceeded $13 million, with more victims still being identified. Johnston was charged with conspiracy to commit wire fraud and conspiracy to commit money laundering, each carrying up to 20 years. Tardibone, described in court papers reported by CBC News as a local exotic car dealer, was charged with money laundering conspiracy and with harbouring Johnston, by housing him in a luxury rental to keep him away from immigration officers. The pair allegedly spent more than $1 million of the proceeds on cars, jewellery and nightlife.

The case began with a traffic stop. In March 2026 a sheriff's deputy in North Miami stopped a white Rolls-Royce Cullinan with Johnston in the back seat, CBC News reported from the court record. Investigators then seized a computer, a phone and handwritten notes. The complaint, written by a Homeland Security Investigations agent, quotes Johnston telling an accomplice on the day of the theft: "We actually smacked a 185btc target today."

Court filings describe a co-conspirator, labelled "Co-Conspirator 1" or CC-1, who celebrated the 185 bitcoin and pushed for "another big one". According to ZachXBT and crypto outlets that read the complaint, CC-1 is Kapllani. One message attributed to CC-1 talked about putting the money into XMR, the ticker for Monero, a privacy coin designed to hide who pays whom, "and living off that".

The trail ZachXBT followed

ZachXBT said he identified Kapllani's Ethereum address from the recording of the April call, then showed that it had received about $5.3 million from the 185 bitcoin theft on 15 March, the day after it happened. By the time of the call, he said, about $1.6 million had already been spent or laundered.

He also tied an older Kapllani wallet to at least $5.85 million taken in five separate thefts between August and October 2025. That wallet address had been posted in a since-deleted Telegram message by John Daghita, known online as "Lick", whom Kapllani had previously faced in an earlier band for band. Daghita is himself charged with taking $46 million in seized crypto from wallets his family's firm managed for the US Marshals Service, a case also exposed by ZachXBT after a filmed wallet contest. Daghita has not been convicted.

ZachXBT also wrote that a memecoin promoter known online as yelotree had been charged with laundering money through a Miami rental car business. Court records name the man charged with laundering as Tardibone, who Crypto Adventure reported is widely discussed online as "Yelo".

Every link in this chain comes from public blockchain records, which show every transfer between addresses forever. They do not show names. Matching an address to a person depends on slips like a recorded screen share, which is why the investigator's claims about Kapllani remain claims until a prosecutor or court tests them.

Guilty pleas, and an open question

On 9 June 2026 Johnston pleaded guilty in federal court in Miami to conspiracy to commit money laundering, and Tardibone pleaded guilty to the same charge, according to CBC News and Crypto Adventure. Johnston agreed to be deported to Canada after sentencing. CBC reported that purchases from the proceeds included a Lamborghini Aventador SVJ, two BMWs, jewellery and a private jet rental, worth about $1.19 million over three months. Sentencing dates had not been announced by October 2026, and Canada's Global Affairs department said it was giving Johnston consular help.

Kapllani's position is the unusual part. He is the person ZachXBT calls the main beneficiary, and he is not a defendant. ZachXBT said he had waited to publish until the charges against the others were public. Reports since May described funds in wallets linked to Kapllani continuing to move. As of October 2026 no charge against Kapllani has been announced. Being named as an unindicted co-conspirator is an accusation by prosecutors, not a finding of guilt.