Alex Wang
Also reported as: devking0718
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Alex Wang. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Portfolio site the cited post publishes, headed devking0718, Senior Blockchain Engineer, under the name Alex, with a portrait and Website/GitHub/Telegram/LinkedIn links. It is the image the identity presented as itself.
Identifiers attributed to this persona
5 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Alex Wang |
alias | |
https://hub.docker.com/u/devking0718 |
dockerhub account | live |
devking0718@gmail.com |
email address | |
https://github.com/devking0718 |
github profile | live |
https://x.com/devking0718 |
x account |
Alex Wang
alias IT Worker Fraud CURATED
Sources
-
The researcher addresses the X account directly and gives the identity's name as Alex Wang. The GitHub account is written in the post as "github[.]comdevking0718", missing the slash; it is transcribed here as the account that string plainly denotes.
x.com/browsercookies/status/1932632035698618626 — Cookie Connoisseur (@browsercookies) -
Found on 17 September 2026 by asking Docker Hub whether an account exists under devking0718, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 22 February 2025. Its full-name field holds an email address rather than a name, devking0718@gmail.com, which this index already carries for this operator — so the account joins on a value the page itself states and not only on the handle. A display name on a profile is a name the account presents, not an identification; here it is the shared address rather than the handle that does the joining.
hub.docker.com/u/devking0718 — Chollima Hunter
https://hub.docker.com/u/devking0718
dockerhub account IT Worker Fraud CURATED live
live
Source
-
Found on 17 September 2026 by asking Docker Hub whether an account exists under devking0718, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 22 February 2025. Its full-name field holds an email address rather than a name, devking0718@gmail.com, which this index already carries for this operator — so the account joins on a value the page itself states and not only on the handle. A display name on a profile is a name the account presents, not an identification; here it is the shared address rather than the handle that does the joining.
hub.docker.com/u/devking0718 — Chollima Hunter
devking0718@gmail.com
email address IT Worker Fraud CURATED
Sources
-
The researcher addresses the X account directly and gives the identity's name as Alex Wang. The GitHub account is written in the post as "github[.]comdevking0718", missing the slash; it is transcribed here as the account that string plainly denotes.
x.com/browsercookies/status/1932632035698618626 — Cookie Connoisseur (@browsercookies) -
Found on 17 September 2026 by asking Docker Hub whether an account exists under devking0718, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 22 February 2025. Its full-name field holds an email address rather than a name, devking0718@gmail.com, which this index already carries for this operator — so the account joins on a value the page itself states and not only on the handle. A display name on a profile is a name the account presents, not an identification; here it is the shared address rather than the handle that does the joining.
hub.docker.com/u/devking0718 — Chollima Hunter
https://github.com/devking0718
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
The researcher addresses the X account directly and gives the identity's name as Alex Wang. The GitHub account is written in the post as "github[.]comdevking0718", missing the slash; it is transcribed here as the account that string plainly denotes.
x.com/browsercookies/status/1932632035698618626 — Cookie Connoisseur (@browsercookies)
https://x.com/devking0718
x account IT Worker Fraud RESEARCHER POST
Source
-
The researcher addresses the X account directly and gives the identity's name as Alex Wang. The GitHub account is written in the post as "github[.]comdevking0718", missing the slash; it is transcribed here as the account that string plainly denotes.
x.com/browsercookies/status/1932632035698618626 — Cookie Connoisseur (@browsercookies)
Sources
- x.com/browsercookies/status/1932632035698618626 — Cookie Connoisseur (@browsercookies)
- hub.docker.com/u/devking0718 — Chollima Hunter