Chollima Hunter

← All personas

Heiner García

A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below was filed under the heading “Onder Kayabasi, a fake blockchain recruiter (Heiner García)” by the report that documented it.

Contagious Interview First reported 2024-06-20

LinkedIn accounts

Identifiers reported alongside

4 indicators filed under the same heading, each with its sources.

IndicatorTypeAccount status
kaankayabasi9060@gmail.com email address —
https://github.com/kaankayabasi github profile removed checked 2026-09-30
https://github.com/onderkayabasi github profile removed checked 2026-09-30
https://x.com/onderkayabasi x account not checked

kaankayabasi9060@gmail.com

email address Contagious Interview RESEARCHER POST

First seen 2024-06-20 · last seen 2024-06-20

Source

  • The post of 20 June 2024 follows a LinkedIn Premium recruiter, Onder Kayabasi, who approached the author for smart-contract and blockchain developers under the company name Peig.io, and whom another LinkedIn user had already reported for running a fake technical interview. It ties the LinkedIn profile to an X account and two GitHub accounts, OnderKayabasi (registered to kaankayabasi9060@gmail.com) and KaanKayabasi, through a shared recruiter biography. The post does not name North Korea; the set is filed unattributed, and the campaign label reflects the fake-interview tradecraft it describes rather than any attribution by the author.
    medium.com/coinmonks/fake-recruiters-in-github-68d0d3bf297d — Heiner García · under “Onder Kayabasi, a fake blockchain recruiter (Heiner García)” · published 2024-06-20 · pulled 2026-09-28

https://github.com/kaankayabasi

github profile Contagious Interview RESEARCHER POST removed checked 2026-09-30

First seen 2024-06-20 · last seen 2024-06-20

Source

  • The post of 20 June 2024 follows a LinkedIn Premium recruiter, Onder Kayabasi, who approached the author for smart-contract and blockchain developers under the company name Peig.io, and whom another LinkedIn user had already reported for running a fake technical interview. It ties the LinkedIn profile to an X account and two GitHub accounts, OnderKayabasi (registered to kaankayabasi9060@gmail.com) and KaanKayabasi, through a shared recruiter biography. The post does not name North Korea; the set is filed unattributed, and the campaign label reflects the fake-interview tradecraft it describes rather than any attribution by the author.
    medium.com/coinmonks/fake-recruiters-in-github-68d0d3bf297d — Heiner García · under “Onder Kayabasi, a fake blockchain recruiter (Heiner García)” · published 2024-06-20 · pulled 2026-09-28

https://github.com/onderkayabasi

github profile Contagious Interview RESEARCHER POST removed checked 2026-09-30

First seen 2024-06-20 · last seen 2024-06-20

Source

  • The post of 20 June 2024 follows a LinkedIn Premium recruiter, Onder Kayabasi, who approached the author for smart-contract and blockchain developers under the company name Peig.io, and whom another LinkedIn user had already reported for running a fake technical interview. It ties the LinkedIn profile to an X account and two GitHub accounts, OnderKayabasi (registered to kaankayabasi9060@gmail.com) and KaanKayabasi, through a shared recruiter biography. The post does not name North Korea; the set is filed unattributed, and the campaign label reflects the fake-interview tradecraft it describes rather than any attribution by the author.
    medium.com/coinmonks/fake-recruiters-in-github-68d0d3bf297d — Heiner García · under “Onder Kayabasi, a fake blockchain recruiter (Heiner García)” · published 2024-06-20 · pulled 2026-09-28

https://x.com/onderkayabasi

x account Contagious Interview RESEARCHER POST

First seen 2024-06-20 · last seen 2024-06-20

Source

  • The post of 20 June 2024 follows a LinkedIn Premium recruiter, Onder Kayabasi, who approached the author for smart-contract and blockchain developers under the company name Peig.io, and whom another LinkedIn user had already reported for running a fake technical interview. It ties the LinkedIn profile to an X account and two GitHub accounts, OnderKayabasi (registered to kaankayabasi9060@gmail.com) and KaanKayabasi, through a shared recruiter biography. The post does not name North Korea; the set is filed unattributed, and the campaign label reflects the fake-interview tradecraft it describes rather than any attribution by the author.
    medium.com/coinmonks/fake-recruiters-in-github-68d0d3bf297d — Heiner García · under “Onder Kayabasi, a fake blockchain recruiter (Heiner García)” · published 2024-06-20 · pulled 2026-09-28

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Heiner García is the name an account presented under, not established to be the name of its operator.