Gary Lee
Also reported as: ChienHui LeeLight FuryLeech DeveloperLight-Furylee_chienhuileech_dev
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below was filed under the heading “Gary Lee / ChienHui Lee / Light Fury / Leech Developer” by the report that documented it.
Profiles and evidence
Composite the researcher published: the persona's X profile (@lee_chienhui), a resume citing leech.developer@gmail.com and a phone number, and the GitHub profile Light Fury.
TRM Labs transaction-flow graph linking the persona's wallets to the OFAC-sanctioned Sang Man Kim.
The OFAC Specially Designated Nationals listing for KIM, Sang Man, reproduced in the post.
LinkedIn accounts
lee-chien-hui-50b157157
removed
linkedin profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as lee-chien-hui-50b157157
Also listed under ChienHui Lee — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…• [Archive](https://web.archive.org/web/20230513202311/https://github.com/light-fury) - medium.com/@leech.developer - linkedin.com/in/lee-chien-hui-50b157157/ - leech.developer@gmail.com - ddpuppy42@yahoo.com - 0xfcd4e8c84afd221d3b8c9c8c374a7784b314d230 (T) -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Identifiers reported alongside
12 indicators filed under the same heading, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Gary Lee |
alias | |
Light Fury |
alias | |
ddpuppy42@yahoo.com |
email address | |
leechdeveloper@gmail.com |
email address | |
lightfury.eth |
ens name | |
https://github.com/light-fury |
github profile | removed |
https://gitlab.com/leech_dev |
gitlab account | live |
https://medium.com/@leech.developer |
medium account | |
+16393899939 |
phone number | |
https://t.me/leech_dev |
telegram account | live |
0xe8a06462628b49eb70dbf114ea510eb3bbbdf559 |
wallet address | |
https://x.com/lee_chienhui |
x account |
Gary Lee
alias IT Worker Fraud CURATED
Also listed under ChienHui Lee — this value’s page names all of them.
Sources
-
The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.
x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under leech_dev, a login the index already carries for this persona on another platform. The profile gives a member-since date of 11 March 2021. It displays the name Gary Lee, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
gitlab.com/leech_dev — Chollima Hunter
Light Fury
alias IT Worker Fraud RESEARCHER POST
Also listed under ChienHui Lee — this value’s page names all of them.
Sources
-
The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.
x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
ddpuppy42@yahoo.com
email address IT Worker Fraud MATCHED IN SOURCE
Also listed under ChienHui Lee — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…medium.com/@leech.developer - linkedin.com/in/lee-chien-hui-50b157157/ - leech.developer@gmail.com - ddpuppy42@yahoo.com - 0xfcd4e8c84afd221d3b8c9c8c374a7784b314d230 (T) - 0x390ed16a3e85758597db7452998d3ea66b65fd84 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
leechdeveloper@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Listed as leech.developer@gmail.com
Also listed under ChienHui Lee — this value’s page names all of them.
Sources
-
The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.
x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…medium.com/@leech.developer - linkedin.com/in/lee-chien-hui-50b157157/ - leech.developer@gmail.com - ddpuppy42@yahoo.com - 0xfcd4e8c84afd221d3b8c9c8c374a7784b314d230 (T) - 0x390ed16a3e85758597db7452998d3ea66b65fd84 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) -
…example, as explained below, the actors used the names LEE Ch an and LEE Ch ienhui, as well as the online identifiers “leech_dev” and “leech.developer@gmail.com.” Case 1:25-cv-01769 Document 1 Filed 06/05/25 Page 31 of 51 32 exchanges .…
Verified Complaint for Forfeiture in Rem, United States v. Virtual Currency Associated with North Korean IT Worker Money Laundering and Sanctions Evasion Conspiracies, No. 1:25-cv-01769 (D.D.C.) — U.S. Department of Justice
lightfury.eth
ens name IT Worker Fraud RESEARCHER POST
Source
-
The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.
x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt)
https://github.com/light-fury
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as light-fury
Also listed under ChienHui Lee — this value’s page names all of them.
removed
Sources
-
The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.
x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…$XGM, Fantom, Preon Finance, Sperax - Light Fury - lightfury - light-fury - leech.developer - leech_dev - x.com/lee_chienhui - github.com/light-fury • [Archive](https://web.archive.org/web/20230513202311/https://github.com/light-fury) - medium.com/@leech.developer -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://gitlab.com/leech_dev
gitlab account IT Worker Fraud CURATED live
live
Source
-
Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under leech_dev, a login the index already carries for this persona on another platform. The profile gives a member-since date of 11 March 2021. It displays the name Gary Lee, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
gitlab.com/leech_dev — Chollima Hunter
https://medium.com/@leech.developer
medium account IT Worker Fraud MATCHED IN SOURCE
Listed as @leech.developer
Source
-
…x.com/lee_chienhui - github.com/light-fury • [Archive](https://web.archive.org/web/20230513202311/https://github.com/light-fury) - medium.com/@leech.developer - linkedin.com/in/lee-chien-hui-50b157157/ - leech.developer@gmail.com - ddpuppy42@yahoo.com -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
+16393899939
phone number IT Worker Fraud RESEARCHER POST
Line type
| Line type | Landline |
|---|---|
| Carrier | IRISTEL INC. |
| Rate centre | SK |
Source
-
The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.
x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt)
https://t.me/leech_dev
telegram account IT Worker Fraud RESEARCHER POST live
live
Source
-
The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.
x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt)
0xe8a06462628b49eb70dbf114ea510eb3bbbdf559
wallet address IT Worker Fraud RESEARCHER POST
Also listed under ChienHui Lee — this value’s page names all of them.
Sources
-
The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.
x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://x.com/lee_chienhui
x account IT Worker Fraud RESEARCHER POST
Also listed under ChienHui Lee — this value’s page names all of them.
Sources
-
The post states this operator transferred over $300,000 from a public ENS address to Kim Sang Man, who is named on the OFAC sanctions list. It gives 'Gary Lee' explicitly as a fake name.
x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- Verified Complaint for Forfeiture in Rem, United States v. Virtual Currency Associated with North Korean IT Worker Money Laundering and Sanctions Evasion Conspiracies, No. 1:25-cv-01769 (D.D.C.) — U.S. Department of Justice, U.S. Attorney's Office for the District of Columbia
- x.com/zachxbt/status/1812856350151766209 — ZachXBT (@zachxbt)
- lazarus.group/team/gary-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- gitlab.com/leech_dev — Chollima Hunter