ZachXBT Tracks $4.59 Million Transfer Linked to Social Engineering Theft

On-chain investigator ZachXBT has reported a significant movement of stolen assets linked to a major social engineering scheme. On May 14, 2026, a threat actor identified as Dritan Kapplani Jr allegedly moved approximately $4.59 million in digital assets. This transaction follows an earlier investigation detailing the theft of 185 BTC, valued at roughly $12.5 million, involving Kapplani and an associate, Trenton Johnson.

Details of the On-Chain Asset Movement

The recent transfer involved a mix of stablecoins and altcoins, specifically 1.99 million DAI and 259 ETH. According to the forensic analysis, the funds reached the destination address 0x67ec1d405e53ed13a19eb77a9db19186723d125d after passing through three intermediary "hops", a common tactic used by malicious actors to obscure the trail of transactions on the Ethereum blockchain.

As of the latest reports, the funds remain idle at the destination address. The breakdown of the tracked movement includes:

• The transfer of nearly 2 million DAI stablecoins.
• The movement of 259 Ethereum (ETH) tokens.
• The utilization of multiple wallet layers to complicate tracking efforts.

Background of the BTC Social Engineering Case

The investigation into Kapplani and Johnson was first publicized by ZachXBT on May 12, 2026. The duo is suspected of orchestrating a social engineering attack that resulted in the loss of 185 Bitcoin. Social engineering in the crypto space often involves psychological manipulation to trick victims into revealing private keys or authorizing malicious transactions.

Dritan and Trenton Johnson are suspected of involvement in a social engineering theft case involving 185 BTC, valued at approximately $12.5 million.

The tracking of these assets is part of a broader effort by blockchain sleuths to identify the individuals behind large-scale exploits. By monitoring the flow of funds to exchanges or centralized services, investigators aim to provide law enforcement with the necessary data to freeze assets and identify suspects.

The continued monitoring of these addresses remains a priority for the security community. While the $4.59 million currently sits in a dormant state, any future attempts to swap these assets for fiat currency or move them to a non-custodial mixer could trigger further alerts across the decentralized finance (DeFi) ecosystem.