Onchain activity shows that Dritan Kapllani Jr. has transferred funds into unfreezeable assets in a new wallet, a few days after ZachXBT identified him as a US-based threat actor allegedly tied to $19 million in social engineering thefts from crypto holders.
ZachXBT was also the one who flagged the latest move, writing on his Telegram channel, “Earlier today the threat actor ‘Dritan Kapllani Jr’ transferred $2.59M (1.99M DAI, 259 ETH) three hops from: 0x4487db847db2fc99372a985743a26f46e0b2bba6 to: 0x67ec1d405e53ed13a19eb77a9db19186723d125d where stolen funds currently sit dormant.”
Dritan’s latest actions are raising questions about whether he is preparing to go into hiding as his co-conspirators face federal charges.
Similar exposures by ZachXBT have led to arrests in the past, with one of them also linked to Dritan.
That one is John “Lick” Daghita, who was arrested in Saint Martin in March 2026 after allegedly stealing $46 million from US government-controlled wallets.
FBI agents reportedly found Daghita with hardware wallets, USB drives, and a metal briefcase of cash after French tactical units helped apprehend him on the Caribbean island.
ZachXBT traces $19 million in alleged thefts to Dritan
ZachXBT’s investigation, published on X, linked Dritan’s Ethereum wallet to the theft of 185 $BTC, worth roughly $13 million, on March 14. One day later, $5.3 million from the stolen funds landed in Dritan’s Exodus wallet, according to Zach’s on-chain tracing.
The exposure came after Dritan joined a “band-for-band” contest on Discord on April 23, where scammers compared wallet balances on screen.
During the call, he allegedly displayed $3.68 million inside an Exodus wallet, according to Cryptopolitan’s earlier reporting. By the time ZachXBT published his findings, about $1.6 million had already been withdrawn from the wallet.
Beyond the 185 $BTC theft, ZachXBT traced an older wallet address back to Dritan through a deleted Telegram post by Daghita.
That wallet allegedly connected to more than $5.85 million across five additional social engineering thefts in 2025, with Bitcoin addresses spanning August through October of that year.
Other associates, such as Trenton Richard David Johnston and Brandon Michael Tardibone, are facing federal charges over the same 185 $BTC theft, with Johnston facing up to 40 years in prison and Tardibone 30 years. ZachXBT identified Dritan as a co-conspirator 1 in Johnston’s case.
A familiar playbook
The connection between Dritan and Daghita predates both investigations. The two engaged in their own band-for-band wallet comparison, ZachXBT said, which was part of what triggered the January 2026 probe into Daghita’s government wallet theft.
In both cases, showing off stolen wealth on social media provided the onchain breadcrumbs that investigators followed.
ZachXBT noted that Dritan has “tons of plot armor,” pointing out that multiple associates from groups known as ACG and 41/RM Boyz have been arrested while Dritan has avoided prosecution.
Since Dritan was recently a minor, ZachXBT suggested that law enforcement may have delayed charges on that basis.
With Johnston and Tardibone now facing decades in federal prison and Daghita awaiting extradition from Saint Martin, the question for investigators is whether Dritan’s apparent fund movements signal a plan to follow Daghita’s exit strategy before charges catch up.