Liu Yuan

A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Liu Yuan. The attribution is theirs, not this site's.

The remainder was read by this site from the account itself and is cited to the page and date it was read.

IT Worker Fraud First reported 2025-08-09

Identifiers attributed to this persona

10 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
Liu Yuan alias —
https://hub.docker.com/u/tinydota9999 dockerhub account live checked 2026-11-08
liuyuan040620@gmail.com email address —
tinydota9999@gmail.com email address —
https://github.com/cupid7650 github profile live checked 2026-09-30
https://github.com/cupidtuny github profile live checked 2026-09-30
https://gitlab.com/liuyuan040620 gitlab account live checked 2026-11-08
cupid-portfolio.vercel.app hosted site —
https://t.me/cupid040620 telegram account live checked 2026-11-08
https://x.com/tinystar0826 x account not checked

Liu Yuan

alias IT Worker Fraud CURATED

First seen 2025-08-09 · last seen 2025-08-09

Sources

  • Two GitHub accounts, an X account, a Telegram handle and a portfolio, with a member page on the Elite Coders team site and a chatkk.com profile. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: elitecoder.vercel.app/assets/images/members/liu-yuan.jpg, chatkk.com/user/liuyuan.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Liu Yuan” · published 2025-08-09 · pulled 2026-08-30
  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- liuyuan040620 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Liu Yuan. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    gitlab.com/liuyuan040620 — Chollima Hunter · under “Liu Yuan” · pulled 2026-09-18
  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- tinydota9999 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 16 May 2024 and a display name of Tomac. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/tinydota9999 — Chollima Hunter · under “Liu Yuan” · pulled 2026-09-18

https://hub.docker.com/u/tinydota9999

dockerhub account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- tinydota9999 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 16 May 2024 and a display name of Tomac. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/tinydota9999 — Chollima Hunter · under “Liu Yuan” · pulled 2026-09-18

liuyuan040620@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two GitHub accounts, an X account, a Telegram handle and a portfolio, with a member page on the Elite Coders team site and a chatkk.com profile. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: elitecoder.vercel.app/assets/images/members/liu-yuan.jpg, chatkk.com/user/liuyuan.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Liu Yuan” · published 2025-08-09 · pulled 2026-08-30

tinydota9999@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two GitHub accounts, an X account, a Telegram handle and a portfolio, with a member page on the Elite Coders team site and a chatkk.com profile. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: elitecoder.vercel.app/assets/images/members/liu-yuan.jpg, chatkk.com/user/liuyuan.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Liu Yuan” · published 2025-08-09 · pulled 2026-08-30

https://github.com/cupid7650

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two GitHub accounts, an X account, a Telegram handle and a portfolio, with a member page on the Elite Coders team site and a chatkk.com profile. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: elitecoder.vercel.app/assets/images/members/liu-yuan.jpg, chatkk.com/user/liuyuan.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Liu Yuan” · published 2025-08-09 · pulled 2026-08-30

https://github.com/cupidtuny

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two GitHub accounts, an X account, a Telegram handle and a portfolio, with a member page on the Elite Coders team site and a chatkk.com profile. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: elitecoder.vercel.app/assets/images/members/liu-yuan.jpg, chatkk.com/user/liuyuan.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Liu Yuan” · published 2025-08-09 · pulled 2026-08-30

https://gitlab.com/liuyuan040620

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- liuyuan040620 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Liu Yuan. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    gitlab.com/liuyuan040620 — Chollima Hunter · under “Liu Yuan” · pulled 2026-09-18

cupid-portfolio.vercel.app

hosted site IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two GitHub accounts, an X account, a Telegram handle and a portfolio, with a member page on the Elite Coders team site and a chatkk.com profile. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: elitecoder.vercel.app/assets/images/members/liu-yuan.jpg, chatkk.com/user/liuyuan.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Liu Yuan” · published 2025-08-09 · pulled 2026-08-30

https://t.me/cupid040620

telegram account IT Worker Fraud RESEARCHER POST live checked 2026-11-08

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two GitHub accounts, an X account, a Telegram handle and a portfolio, with a member page on the Elite Coders team site and a chatkk.com profile. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: elitecoder.vercel.app/assets/images/members/liu-yuan.jpg, chatkk.com/user/liuyuan.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Liu Yuan” · published 2025-08-09 · pulled 2026-08-30

https://x.com/tinystar0826

x account IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two GitHub accounts, an X account, a Telegram handle and a portfolio, with a member page on the Elite Coders team site and a chatkk.com profile. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: elitecoder.vercel.app/assets/images/members/liu-yuan.jpg, chatkk.com/user/liuyuan.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Liu Yuan” · published 2025-08-09 · pulled 2026-08-30

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Liu Yuan as the name of the operator is the cited researcher’s assertion, repeated here as their claim.