May Lee

Also reported as: JinHai

A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, May Lee. The attribution is theirs, not this site's.

The remainder was read by this site from the account itself and is cited to the page and date it was read.

IT Worker Fraud First reported 2026-04-17

Identifiers attributed to this persona

7 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
JinHai alias —
May Lee alias —
https://dev.to/may79 devto account live checked 2026-11-08
princetall501@gmail.com email address —
https://github.com/may79 github profile live checked 2026-09-30
https://gitlab.com/may79 gitlab account live checked 2026-11-08
https://huggingface.co/may79 huggingface account live checked 2026-11-08

JinHai

alias IT Worker Fraud RESEARCHER POST

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven: commits under two names, May Lee and JinHai, from one address.
    x.com/meow_mfer/status/2045104494862889433 — meow mfer (@meow_mfer) · under “May Lee / JinHai” · published 2026-04-17 · pulled 2026-08-30

May Lee

alias IT Worker Fraud CURATED

First seen 2026-04-17 · last seen 2026-04-17

Sources

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven: commits under two names, May Lee and JinHai, from one address.
    x.com/meow_mfer/status/2045104494862889433 — meow mfer (@meow_mfer) · under “May Lee / JinHai” · published 2026-04-17 · pulled 2026-08-30
  • Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under may79, a login the index already carries for this persona on another platform. The profile gives a member-since date of 16 August 2021. It displays the name May Lee, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
    gitlab.com/may79 — Chollima Hunter · under “May Lee” · pulled 2026-09-13
  • Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under may79, a login the index already carries for this persona on another platform. It gives a joined date of Aug 26, 2021. It displays the name May Lee, the same name the reporting already gives. The profile links a GitHub account, may79. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    dev.to/may79 — Chollima Hunter · under “May Lee” · pulled 2026-09-13
  • Found on 17 September 2026 by asking Hugging Face whether an account exists under may79, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of nena. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    huggingface.co/may79 — Chollima Hunter · under “May Lee” · pulled 2026-09-17

https://dev.to/may79

devto account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under may79, a login the index already carries for this persona on another platform. It gives a joined date of Aug 26, 2021. It displays the name May Lee, the same name the reporting already gives. The profile links a GitHub account, may79. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    dev.to/may79 — Chollima Hunter · under “May Lee” · pulled 2026-09-13

princetall501@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven: commits under two names, May Lee and JinHai, from one address.
    x.com/meow_mfer/status/2045108002836099351 — meow mfer (@meow_mfer) · under “May Lee / JinHai” · published 2026-04-17 · pulled 2026-08-30

https://github.com/may79

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven: commits under two names, May Lee and JinHai, from one address.
    x.com/meow_mfer/status/2045107378249720221 — meow mfer (@meow_mfer) · under “May Lee / JinHai” · published 2026-04-17 · pulled 2026-08-30

https://gitlab.com/may79

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under may79, a login the index already carries for this persona on another platform. The profile gives a member-since date of 16 August 2021. It displays the name May Lee, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
    gitlab.com/may79 — Chollima Hunter · under “May Lee” · pulled 2026-09-13

https://huggingface.co/may79

huggingface account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 17 September 2026 by asking Hugging Face whether an account exists under may79, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of nena. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    huggingface.co/may79 — Chollima Hunter · under “May Lee” · pulled 2026-09-17

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. May Lee as the name of the operator is the cited researcher’s assertion, repeated here as their claim.