Matias Diaz

Also reported as: Kei Nakanomndiaz270xdefilover

A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's.

IT Worker Fraud

Profiles and evidence

Identifiers attributed to this persona

5 indicators the source attributes to this operator, each with its sources.

IndicatorTypeAccount status
Kei Nakano alias —
Matias Diaz alias —
https://github.com/0xdefilover github profile live checked 2026-08-30
0x961194d781623ebf5ce43087d85d2731cf1e7d1c wallet address —
0x9d66bea448eed9bdbb5f1acf032767b11fc78dcf wallet address —

Kei Nakano

alias IT Worker Fraud THIRD-PARTY REGISTRY

Also listed under Kei Nakano — this value’s page names all of them.

First seen unknown · last seen unknown

Sources

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/kei-nakano — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kei Nakano / smartcoding51 / Jin Wang / fantasticfullstackdev / webdevninja / Jinathin / kei-tren / 0xachilles509” · pulled 2026-09-09
  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/matias-diaz — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Matias Diaz / Kei Nakano / mndiaz27 / 0xdefilover” · pulled 2026-09-09

Matias Diaz

alias IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/matias-diaz — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Matias Diaz / Kei Nakano / mndiaz27 / 0xdefilover” · pulled 2026-09-09

https://github.com/0xdefilover

github profile IT Worker Fraud MATCHED IN SOURCE live checked 2026-08-30

Listed as 0xdefilover

First seen 2026-08-30 · last seen 2026-10-18

Sources

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/matias-diaz — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Matias Diaz / Kei Nakano / mndiaz27 / 0xdefilover” · pulled 2026-09-09
  • …Diaz / Kei Nakano - 2025 - mndiaz27 - 0xdefilover - github.com/0xdefilover • [Archive](https://web.archive.org/web/20250827055628/https://github.com/0xdefilover) - 0x9d66bea448eed9bdbb5f1acf032767b11fc78dcf - 0x961194d781623ebf5ce43087d85d2731cf1e7d1c #### Russell Hieu / Shota Nakamura - 2024,…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Matias Diaz / Kei Nakano” · published 2025-06-19 · pulled 2026-08-30

0x961194d781623ebf5ce43087d85d2731cf1e7d1c

wallet address IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/matias-diaz — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Matias Diaz / Kei Nakano / mndiaz27 / 0xdefilover” · pulled 2026-09-09

0x9d66bea448eed9bdbb5f1acf032767b11fc78dcf

wallet address IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/matias-diaz — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Matias Diaz / Kei Nakano / mndiaz27 / 0xdefilover” · pulled 2026-09-09

Sources

  • DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Matias Diaz / Kei Nakano” · published 2025-06-19 · pulled 2026-08-30
  • lazarus.group/team/kei-nakano — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kei Nakano / smartcoding51 / Jin Wang / fantasticfullstackdev / webdevninja / Jinathin / kei-tren / 0xachilles509” · pulled 2026-09-09
  • lazarus.group/team/matias-diaz — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Matias Diaz / Kei Nakano / mndiaz27 / 0xdefilover” · pulled 2026-09-09

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Matias Diaz as the name of the operator is the cited researcher’s assertion, repeated here as their claim.