James Honeycutt
James Honeycutt is an alias
that 3 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from meow mfer (@meow_mfer), bbsz (@blackbigswan) and Chollima Hunter.
The earliest of those reports is dated 2026-04-17 and the most recent 2026-10-04.
The reporting files it under the persona James Honeycutt, alongside 9 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
alias IT Worker Fraud CURATED
Sources
-
A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven gives the profile as James Honeycutt of Jacksonville, Florida, while the commits are authored as KevinGrant-dev with this address and the account holds a portfolio repository under the Kevin Grant name; the previous username was KevinGrant-dev. Post nine records the account created on 7 March 2022 within minutes of MBenz12.
x.com/meow_mfer/status/2045104494862889433 — meow mfer (@meow_mfer) -
The researcher describes a small data leak found on a GitHub account run by an IT worker, about two months old when posted, setting out a multi-tier pipeline for recruiting facilitators the workers call employees, and lists the account and four addresses as its indicators. 0xprincedev and enthusiast0807@gmail.com were already filed under this persona from a commit tally of the jamesh0807 repositories on 20 September 2026, which is what places the other three addresses here. Read on 26 October 2026 with both replies, which add nothing.
x.com/blackbigswan/status/2106733573097070597 — bbsz (@blackbigswan) -
Read on 20 September 2026 by tallying which GitHub logins have authored commits in the repositories of github.com/jamesh0807, an account already held under this persona. 0xprincedev has authored thirty of them, more than twice what the account itself has authored there under its own login. It was registered on 1 April 2022, three weeks after jamesh0807, displays the name Prince, and publishes enthusiast0807@gmail.com on its profile, an address this index did not hold. That address carries the same 0807 the held account carries in its own login, which is a value the account publishes rather than a resemblance between two handles. The account holds seventy-one public repositories and has a hundred and forty-two followers, so it is not the throwaway shape the rest of this set has; a commit address and a commit count establish who wrote those commits, not who holds either account.
github.com/0xprincedev — Chollima Hunter
Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.
Related indicators
Same persona record: James Honeycutt
All 9 on the James Honeycutt page
Cited by the same report: x.com/meow_mfer/status/2045104494862889433
All 6 indicators from this source