ChienHui Lee
Also reported as: Gary LeeLight FuryLeech Developerlightfurylight-furyleech.developerleech_dev
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Photograph published by the registry under this persona, captioned there as “Profile picture of Gary Lee.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Profiles and evidence
Screenshot published by the registry under this persona, captioned there as “Profile picture of Gary Lee (ChienHui Lee).”, kept as a record of the profile it shows.
Identity document published by the registry under this persona, captioned there as “Gary Lee with Karlo Lee Chan.”. The registry presents it as a document used for this identity. Its name, number and photograph are the document's own and may belong to a real person whose identity was stolen to build the persona.
LinkedIn accounts
https://www.linkedin.com/in/lee-chien-hui-50b157157/
removed
linkedin profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as lee-chien-hui-50b157157
Also listed under Gary Lee — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…• [Archive](https://web.archive.org/web/20230513202311/https://github.com/light-fury) - medium.com/@leech.developer - linkedin.com/in/lee-chien-hui-50b157157/ - leech.developer@gmail.com - ddpuppy42@yahoo.com - 0xfcd4e8c84afd221d3b8c9c8c374a7784b314d230 (T) -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Identifiers reported alongside
13 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
ChienHui Lee |
alias | |
Gary Lee |
alias | |
Leech Developer |
alias | |
Light Fury |
alias | |
lightfury |
alias | |
ddpuppy42@yahoo.com |
email address | |
leechdeveloper@gmail.com |
email address | |
https://github.com/light-fury |
github profile | removed |
0x390ed16a3e85758597db7452998d3ea66b65fd84 |
wallet address | |
0x4ab0eac00d1a5b05e7a484f8678dce68b849545a |
wallet address | |
0xe8a06462628b49eb70dbf114ea510eb3bbbdf559 |
wallet address | |
0xfcd4e8c84afd221d3b8c9c8c374a7784b314d230 |
wallet address | |
https://x.com/lee_chienhui |
x account |
ChienHui Lee
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Gary Lee
alias IT Worker Fraud CURATED
Also listed under Gary Lee — this value’s page names all of them.
Sources
-
The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.
x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under leech_dev, a login the index already carries for this persona on another platform. The profile gives a member-since date of 11 March 2021. It displays the name Gary Lee, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
gitlab.com/leech_dev — Chollima Hunter
Leech Developer
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Light Fury
alias IT Worker Fraud RESEARCHER POST
Also listed under Gary Lee — this value’s page names all of them.
Sources
-
The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.
x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
lightfury
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
ddpuppy42@yahoo.com
email address IT Worker Fraud MATCHED IN SOURCE
Also listed under Gary Lee — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…medium.com/@leech.developer - linkedin.com/in/lee-chien-hui-50b157157/ - leech.developer@gmail.com - ddpuppy42@yahoo.com - 0xfcd4e8c84afd221d3b8c9c8c374a7784b314d230 (T) - 0x390ed16a3e85758597db7452998d3ea66b65fd84 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
leechdeveloper@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Listed as leech.developer@gmail.com
Also listed under Gary Lee — this value’s page names all of them.
Sources
-
The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.
x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…medium.com/@leech.developer - linkedin.com/in/lee-chien-hui-50b157157/ - leech.developer@gmail.com - ddpuppy42@yahoo.com - 0xfcd4e8c84afd221d3b8c9c8c374a7784b314d230 (T) - 0x390ed16a3e85758597db7452998d3ea66b65fd84 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) -
…example, as explained below, the actors used the names LEE Ch an and LEE Ch ienhui, as well as the online identifiers “leech_dev” and “leech.developer@gmail.com.” Case 1:25-cv-01769 Document 1 Filed 06/05/25 Page 31 of 51 32 exchanges .…
Verified Complaint for Forfeiture in Rem, United States v. Virtual Currency Associated with North Korean IT Worker Money Laundering and Sanctions Evasion Conspiracies, No. 1:25-cv-01769 (D.D.C.) — U.S. Department of Justice
https://github.com/light-fury
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as light-fury
Also listed under Gary Lee — this value’s page names all of them.
removed
Sources
-
The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.
x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…$XGM, Fantom, Preon Finance, Sperax - Light Fury - lightfury - light-fury - leech.developer - leech_dev - x.com/lee_chienhui - github.com/light-fury • [Archive](https://web.archive.org/web/20230513202311/https://github.com/light-fury) - medium.com/@leech.developer -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
0x390ed16a3e85758597db7452998d3ea66b65fd84
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0x4ab0eac00d1a5b05e7a484f8678dce68b849545a
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0xe8a06462628b49eb70dbf114ea510eb3bbbdf559
wallet address IT Worker Fraud RESEARCHER POST
Also listed under Gary Lee — this value’s page names all of them.
Sources
-
The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.
x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0xfcd4e8c84afd221d3b8c9c8c374a7784b314d230
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://x.com/lee_chienhui
x account IT Worker Fraud RESEARCHER POST
Also listed under Gary Lee — this value’s page names all of them.
Sources
-
The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.
x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- Verified Complaint for Forfeiture in Rem, United States v. Virtual Currency Associated with North Korean IT Worker Money Laundering and Sanctions Evasion Conspiracies, No. 1:25-cv-01769 (D.D.C.) — U.S. Department of Justice, U.S. Attorney's Office for the District of Columbia
- x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt)
- lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- gitlab.com/leech_dev — Chollima Hunter