billjack0202@gmail.com
billjack0202@gmail.com is an email address
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from meow mfer (@meow_mfer).
The report is dated 2026-05-10.
The reporting files it under the persona anthon-dev, alongside 26 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
email address IT Worker Fraud RESEARCHER POST
Source
-
A thirteen-part investigation into a suspected DPRK IT worker the researcher describes as having been employed at ThorSwap, where three of its pull requests were merged into the SwapKit SDK that powers the exchange's cross-chain swaps. The four GitHub accounts are tied together by the recurring number patterns 914 and 425 in their handles and addresses, and to each other by a single address registered on a DPRK-operated freelancing platform the researcher reached through exposed database credentials. anthon-dev is the identity used at ThorSwap and gives the persona its name; the other handles are the portfolio, job-application and private-fork accounts the same operator ran. Three further accounts are named as collaborators on shared repositories rather than as the same person, one of them already suspended. The wallet is the factory contract for Gocheto, a separate exchange the researcher says the operator built, and is listed in the thread's own closing indicator summary. Two accounts that appear alongside these in the same repositories are ThorSwap's own employees and are recorded in the held-back list instead. The collaborator accounts and their addresses are filed separately as unattributed rather than under this persona.
x.com/meow_mfer/status/2053431647530598521 — meow mfer (@meow_mfer)
Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.