https://github.com/0xprincedev
https://github.com/0xprincedev is a GitHub account
that 2 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from bbsz (@blackbigswan) and Chollima Hunter.
The earliest of those reports is dated 2026-09-20 and the most recent 2026-10-04.
The reporting files it under the persona James Honeycutt, alongside 9 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
github profile IT Worker Fraud CURATED live
live
Sources
-
The researcher describes a small data leak found on a GitHub account run by an IT worker, about two months old when posted, setting out a multi-tier pipeline for recruiting facilitators the workers call employees, and lists the account and four addresses as its indicators. 0xprincedev and enthusiast0807@gmail.com were already filed under this persona from a commit tally of the jamesh0807 repositories on 20 September 2026, which is what places the other three addresses here. Read on 26 October 2026 with both replies, which add nothing.
x.com/blackbigswan/status/2106733573097070597 — bbsz (@blackbigswan) -
Read on 20 September 2026 by tallying which GitHub logins have authored commits in the repositories of github.com/jamesh0807, an account already held under this persona. 0xprincedev has authored thirty of them, more than twice what the account itself has authored there under its own login. It was registered on 1 April 2022, three weeks after jamesh0807, displays the name Prince, and publishes enthusiast0807@gmail.com on its profile, an address this index did not hold. That address carries the same 0807 the held account carries in its own login, which is a value the account publishes rather than a resemblance between two handles. The account holds seventy-one public repositories and has a hundred and forty-two followers, so it is not the throwaway shape the rest of this set has; a commit address and a commit count establish who wrote those commits, not who holds either account.
github.com/0xprincedev — Chollima Hunter
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.
Account analysis
| Account created | 2022-04-01 |
|---|---|
| Repositories | 44 original, 27 forked |
| History older than the account | 3 repositories: binance-trading-bot (first commit 2021-05-21), HTML-CSS-Training (first commit 2020-09-03), otc-wallet (first commit 2022-03-23) |
| Commits copied into others' repositories | 0 |
| Commit identities | 2 addresses, 4 names; up to 4 names on one address; up to 2 addresses under one name |
Commit addresses this index holds
Followed by these indexed accounts
Related indicators
Same persona record: James Honeycutt
All 9 on the James Honeycutt page