James Honeycutt
Also reported as: Kevin Grant
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, James Honeycutt. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Identifiers attributed to this persona
10 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
James Honeycutt |
alias | |
Kevin Grant |
alias | |
bluedreamsmartdev@gmail.com |
email address | |
enthusiast0807@gmail.com |
email address | |
enthusiast301@gmail.com |
email address | |
kevingrant0301@gmail.com |
email address | |
risto0301@gmail.com |
email address | |
https://github.com/0xprincedev |
github profile | live |
https://github.com/jamesh0807 |
github profile | live |
https://github.com/kevingrant-dev |
github profile | removed |
James Honeycutt
alias IT Worker Fraud CURATED
Sources
-
A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven gives the profile as James Honeycutt of Jacksonville, Florida, while the commits are authored as KevinGrant-dev with this address and the account holds a portfolio repository under the Kevin Grant name; the previous username was KevinGrant-dev. Post nine records the account created on 7 March 2022 within minutes of MBenz12.
x.com/meow_mfer/status/2045104494862889433 — meow mfer (@meow_mfer) -
The researcher describes a small data leak found on a GitHub account run by an IT worker, about two months old when posted, setting out a multi-tier pipeline for recruiting facilitators the workers call employees, and lists the account and four addresses as its indicators. 0xprincedev and enthusiast0807@gmail.com were already filed under this persona from a commit tally of the jamesh0807 repositories on 20 September 2026, which is what places the other three addresses here. Read on 26 October 2026 with both replies, which add nothing.
x.com/blackbigswan/status/2106733573097070597 — bbsz (@blackbigswan) -
Read on 20 September 2026 by tallying which GitHub logins have authored commits in the repositories of github.com/jamesh0807, an account already held under this persona. 0xprincedev has authored thirty of them, more than twice what the account itself has authored there under its own login. It was registered on 1 April 2022, three weeks after jamesh0807, displays the name Prince, and publishes enthusiast0807@gmail.com on its profile, an address this index did not hold. That address carries the same 0807 the held account carries in its own login, which is a value the account publishes rather than a resemblance between two handles. The account holds seventy-one public repositories and has a hundred and forty-two followers, so it is not the throwaway shape the rest of this set has; a commit address and a commit count establish who wrote those commits, not who holds either account.
github.com/0xprincedev — Chollima Hunter
Kevin Grant
alias IT Worker Fraud RESEARCHER POST
Source
-
A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven gives the profile as James Honeycutt of Jacksonville, Florida, while the commits are authored as KevinGrant-dev with this address and the account holds a portfolio repository under the Kevin Grant name; the previous username was KevinGrant-dev. Post nine records the account created on 7 March 2022 within minutes of MBenz12.
x.com/meow_mfer/status/2045104494862889433 — meow mfer (@meow_mfer)
bluedreamsmartdev@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The researcher describes a small data leak found on a GitHub account run by an IT worker, about two months old when posted, setting out a multi-tier pipeline for recruiting facilitators the workers call employees, and lists the account and four addresses as its indicators. 0xprincedev and enthusiast0807@gmail.com were already filed under this persona from a commit tally of the jamesh0807 repositories on 20 September 2026, which is what places the other three addresses here. Read on 26 October 2026 with both replies, which add nothing.
x.com/blackbigswan/status/2106733573097070597 — bbsz (@blackbigswan)
enthusiast0807@gmail.com
email address IT Worker Fraud CURATED
Sources
-
The researcher describes a small data leak found on a GitHub account run by an IT worker, about two months old when posted, setting out a multi-tier pipeline for recruiting facilitators the workers call employees, and lists the account and four addresses as its indicators. 0xprincedev and enthusiast0807@gmail.com were already filed under this persona from a commit tally of the jamesh0807 repositories on 20 September 2026, which is what places the other three addresses here. Read on 26 October 2026 with both replies, which add nothing.
x.com/blackbigswan/status/2106733573097070597 — bbsz (@blackbigswan) -
Read on 20 September 2026 by tallying which GitHub logins have authored commits in the repositories of github.com/jamesh0807, an account already held under this persona. 0xprincedev has authored thirty of them, more than twice what the account itself has authored there under its own login. It was registered on 1 April 2022, three weeks after jamesh0807, displays the name Prince, and publishes enthusiast0807@gmail.com on its profile, an address this index did not hold. That address carries the same 0807 the held account carries in its own login, which is a value the account publishes rather than a resemblance between two handles. The account holds seventy-one public repositories and has a hundred and forty-two followers, so it is not the throwaway shape the rest of this set has; a commit address and a commit count establish who wrote those commits, not who holds either account.
github.com/0xprincedev — Chollima Hunter
enthusiast301@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The researcher describes a small data leak found on a GitHub account run by an IT worker, about two months old when posted, setting out a multi-tier pipeline for recruiting facilitators the workers call employees, and lists the account and four addresses as its indicators. 0xprincedev and enthusiast0807@gmail.com were already filed under this persona from a commit tally of the jamesh0807 repositories on 20 September 2026, which is what places the other three addresses here. Read on 26 October 2026 with both replies, which add nothing.
x.com/blackbigswan/status/2106733573097070597 — bbsz (@blackbigswan)
kevingrant0301@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Listed as kevingrant.0301@gmail.com
Sources
-
A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven gives the profile as James Honeycutt of Jacksonville, Florida, while the commits are authored as KevinGrant-dev with this address and the account holds a portfolio repository under the Kevin Grant name; the previous username was KevinGrant-dev. Post nine records the account created on 7 March 2022 within minutes of MBenz12.
x.com/meow_mfer/status/2045108002836099351 — meow mfer (@meow_mfer) -
…il.com kennydavis120@gmail.com kennydavis120@proton.me kennydavis1990123@gmail.com kevin.dev921115@gmail.com kevin.escalante.0710@gmail.com kevingrant.0301@gmail.com kevinipineda0315@gmail.com kevinmiller0928@gmail.com kevintech1020@gmail.com kevinwise1016@gmail.com kexakoh218@appxapi.com khxehpg371@mail…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
risto0301@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The researcher describes a small data leak found on a GitHub account run by an IT worker, about two months old when posted, setting out a multi-tier pipeline for recruiting facilitators the workers call employees, and lists the account and four addresses as its indicators. 0xprincedev and enthusiast0807@gmail.com were already filed under this persona from a commit tally of the jamesh0807 repositories on 20 September 2026, which is what places the other three addresses here. Read on 26 October 2026 with both replies, which add nothing.
x.com/blackbigswan/status/2106733573097070597 — bbsz (@blackbigswan)
https://github.com/0xprincedev
github profile IT Worker Fraud CURATED live
live
Sources
-
The researcher describes a small data leak found on a GitHub account run by an IT worker, about two months old when posted, setting out a multi-tier pipeline for recruiting facilitators the workers call employees, and lists the account and four addresses as its indicators. 0xprincedev and enthusiast0807@gmail.com were already filed under this persona from a commit tally of the jamesh0807 repositories on 20 September 2026, which is what places the other three addresses here. Read on 26 October 2026 with both replies, which add nothing.
x.com/blackbigswan/status/2106733573097070597 — bbsz (@blackbigswan) -
Read on 20 September 2026 by tallying which GitHub logins have authored commits in the repositories of github.com/jamesh0807, an account already held under this persona. 0xprincedev has authored thirty of them, more than twice what the account itself has authored there under its own login. It was registered on 1 April 2022, three weeks after jamesh0807, displays the name Prince, and publishes enthusiast0807@gmail.com on its profile, an address this index did not hold. That address carries the same 0807 the held account carries in its own login, which is a value the account publishes rather than a resemblance between two handles. The account holds seventy-one public repositories and has a hundred and forty-two followers, so it is not the throwaway shape the rest of this set has; a commit address and a commit count establish who wrote those commits, not who holds either account.
github.com/0xprincedev — Chollima Hunter
https://github.com/jamesh0807
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven gives the profile as James Honeycutt of Jacksonville, Florida, while the commits are authored as KevinGrant-dev with this address and the account holds a portfolio repository under the Kevin Grant name; the previous username was KevinGrant-dev. Post nine records the account created on 7 March 2022 within minutes of MBenz12.
x.com/meow_mfer/status/2045108002836099351 — meow mfer (@meow_mfer)
https://github.com/kevingrant-dev
github profile IT Worker Fraud RESEARCHER POST removed
removed
Source
-
A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven gives the profile as James Honeycutt of Jacksonville, Florida, while the commits are authored as KevinGrant-dev with this address and the account holds a portfolio repository under the Kevin Grant name; the previous username was KevinGrant-dev. Post nine records the account created on 7 March 2022 within minutes of MBenz12.
x.com/meow_mfer/status/2045108002836099351 — meow mfer (@meow_mfer)
Sources
- Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
- x.com/meow_mfer/status/2045108002836099351 — meow mfer (@meow_mfer)
- x.com/meow_mfer/status/2045104494862889433 — meow mfer (@meow_mfer)
- x.com/blackbigswan/status/2106733573097070597 — bbsz (@blackbigswan)
- github.com/0xprincedev — Chollima Hunter