Chollima Hunter

← Remote Workers

hodlwarden@gmail.com

hodlwarden@gmail.com is an email address that 3 published sources report in connection with IT Worker Fraud and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from tanuki42 (@tanuki42_), Lazarus Group DPRK IT-Worker Registry (lazarus.group) and Chollima Hunter. The earliest of those reports is dated 2026-08-14 and the most recent 2026-09-24.

The reporting files it under the persona Ming Cheng, alongside 13 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

email address IT Worker FraudContagious Interview CURATED

First seen 2026-08-14 · last seen 2026-09-24

Sources

  • The researcher describes interviewing this identity as an applicant for a remote engineering role and assessing them as a North Korean IT worker. The account is presented under the name Ming Cheng. The thread notes a three-year gap in the resume covering 2018 to 2021, which the applicant explained as COVID-19 treatment beginning in 2019, months before the virus was known in China, and says the interview was cut short by a connection problem shortly after the applicant was asked whether he was North Korean. The third post of that thread publishes the whole application under the heading "all the fake details he applied with for anyone tracking", and is where the address, telephone number, GitHub, Telegram, IP address and website here come from. It was missed on the first pass: X renders a post that long behind a Show more control, and the syndication endpoint the reader uses returns it truncated and says so. It has to be read in a browser. That post also attributes the GitHub account to the Contagious Trader campaign, weaponised cryptocurrency trading bots, citing kmsec's write-up, which is already a source here; this entry carries that label alongside IT Worker Fraud because the researcher makes both claims. This is a second, independent researcher reaching the same conclusion about an identity the lazarus.group registry already records, so the account carries both citations. Two days after the thread that named this operator, the researcher reported that it had rotated to a new persona, 0xcrypoops, and gave the replacement X, GitHub and Telegram accounts. The three are recorded here rather than as a separate persona because the source states outright that they are the same operator continuing. Note that the Telegram handle for the replacement is not a copy of the other two: it begins with the letter o where the X and GitHub handles begin with a zero, and it is transcribed as the post links it.
    x.com/tanuki42_/status/2088278349487759785 — tanuki42 (@tanuki42_) · under “Ming Cheng / hodlwarden / 0xcrypoops / Nikolic Chirag” · published 2026-08-14 · pulled 2026-08-30
  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/ming-cheng — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Ming Cheng / Nikolic Chirag / hodlwarden / hodl_warden” · pulled 2026-09-09
  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 63 commits signed hodlwarden@gmail.com, an address the lazarus.group registry publishes for this persona, to github.com/crypdev007, account id 37245718, created on 10 March 2018, display name crypdev007, with 74 public repositories.
    github.com/crypdev007 — Chollima Hunter · under “Ming Cheng” · pulled 2026-09-24

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Same persona record: Ming Cheng

Other identifiers the reporting files under the same persona; 8 of 13 are shown.

All 13 on the Ming Cheng page

Cited by the same report: x.com/tanuki42_/status/2088278349487759785

tanuki42 (@tanuki42_) lists 5 other indicators in this source. 2 are shown, chosen across types.

All 6 indicators from this source

Cited by the same report: lazarus.group/team/ming-cheng

Lazarus Group DPRK IT-Worker Registry (lazarus.group) lists 6 other indicators in this source. 1 are shown, chosen across types.

All 7 indicators from this source

Cited by the same report: github.com/crypdev007

Chollima Hunter lists 1 other indicator in this source.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.