https://github.com/smartdev914

https://github.com/smartdev914 is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from meow mfer (@meow_mfer). The report is dated 2026-05-10.

The reporting files it under the persona anthon-dev, alongside 26 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2026-05-10 · last seen 2026-05-10

Source

  • A thirteen-part investigation into a suspected DPRK IT worker the researcher describes as having been employed at ThorSwap, where three of its pull requests were merged into the SwapKit SDK that powers the exchange's cross-chain swaps. The four GitHub accounts are tied together by the recurring number patterns 914 and 425 in their handles and addresses, and to each other by a single address registered on a DPRK-operated freelancing platform the researcher reached through exposed database credentials. anthon-dev is the identity used at ThorSwap and gives the persona its name; the other handles are the portfolio, job-application and private-fork accounts the same operator ran. Three further accounts are named as collaborators on shared repositories rather than as the same person, one of them already suspended. The wallet is the factory contract for Gocheto, a separate exchange the researcher says the operator built, and is listed in the thread's own closing indicator summary. Two accounts that appear alongside these in the same repositories are ThorSwap's own employees and are recorded in the held-back list instead. The collaborator accounts and their addresses are filed separately as unattributed rather than under this persona.
    x.com/meow_mfer/status/2053431647530598521 — meow mfer (@meow_mfer) · under “anthon-dev / smartdev914 / promisingdev425 / onedev425 / fmkt18dev” · published 2026-05-10 · pulled 2026-08-30

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created2022-07-21
Repositories33 original, 6 forked
History older than the account3 repositories: rust_graphql (first commit 2020-10-22), utopia_trading (first commit 2021-10-12), zoom-support (first commit 2021-04-02)
Commits copied into others' repositories0
Commit identities1 address, 3 names; up to 3 names on one address; up to 2 addresses under one name

Commit addresses this index holds

Followed by these indexed accounts

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-08. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Same persona record: anthon-dev

Other identifiers the reporting files under the same persona; 8 of 26 are shown.

All 26 on the anthon-dev page

Cited by the same report: x.com/meow_mfer/status/2053431647530598521

meow mfer (@meow_mfer) lists 4 other indicators in this source.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.