Ming Cheng

Ming Cheng

alias IT Worker FraudContagious Interview CURATED

First seen 2026-08-14 · last seen 2026-09-24

Sources

• The researcher describes interviewing this identity as an applicant for a remote engineering role and assessing them as a North Korean IT worker. The account is presented under the name Ming Cheng. The thread notes a three-year gap in the resume covering 2018 to 2021, which the applicant explained as COVID-19 treatment beginning in 2019, months before the virus was known in China, and says the interview was cut short by a connection problem shortly after the applicant was asked whether he was North Korean. The third post of that thread publishes the whole application under the heading "all the fake details he applied with for anyone tracking", and is where the address, telephone number, GitHub, Telegram, IP address and website here come from. It was missed on the first pass: X renders a post that long behind a Show more control, and the syndication endpoint the reader uses returns it truncated and says so. It has to be read in a browser. That post also attributes the GitHub account to the Contagious Trader campaign, weaponised cryptocurrency trading bots, citing kmsec's write-up, which is already a source here; this entry carries that label alongside IT Worker Fraud because the researcher makes both claims. This is a second, independent researcher reaching the same conclusion about an identity the lazarus.group registry already records, so the account carries both citations. Two days after the thread that named this operator, the researcher reported that it had rotated to a new persona, 0xcrypoops, and gave the replacement X, GitHub and Telegram accounts. The three are recorded here rather than as a separate persona because the source states outright that they are the same operator continuing. Note that the Telegram handle for the replacement is not a copy of the other two: it begins with the letter o where the X and GitHub handles begin with a zero, and it is transcribed as the post links it.

  x.com/tanuki42_/status/2088278343653413254 — tanuki42 (@tanuki42_) · under “Ming Cheng / hodlwarden / 0xcrypoops / Nikolic Chirag” · published 2026-08-14 · pulled 2026-08-30

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/ming-cheng — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Ming Cheng / Nikolic Chirag / hodlwarden / hodl_warden” · pulled 2026-09-09

• Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. A GitLab account under hodlwarden, one of the logins attributed to this operator, created on 9 April 2026 — months after the reporting that named the handle, which makes it the only account here the operator is known to have opened since being written about. It displays "Hodl Warden", which is the handle spaced out rather than a name, and carries no bio, location or links.

  gitlab.com/hodlwarden — Chollima Hunter · under “Ming Cheng” · pulled 2026-09-12

• Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 63 commits signed hodlwarden@gmail.com, an address the lazarus.group registry publishes for this persona, to github.com/crypdev007, account id 37245718, created on 10 March 2018, display name crypdev007, with 74 public repositories.

  github.com/crypdev007 — Chollima Hunter · under “Ming Cheng” · pulled 2026-09-24

Nikolic Chirag

alias IT Worker FraudContagious Interview RESEARCHER POST

First seen 2026-08-14 · last seen 2026-08-14

Sources

• The researcher describes interviewing this identity as an applicant for a remote engineering role and assessing them as a North Korean IT worker. The account is presented under the name Ming Cheng. The thread notes a three-year gap in the resume covering 2018 to 2021, which the applicant explained as COVID-19 treatment beginning in 2019, months before the virus was known in China, and says the interview was cut short by a connection problem shortly after the applicant was asked whether he was North Korean. The third post of that thread publishes the whole application under the heading "all the fake details he applied with for anyone tracking", and is where the address, telephone number, GitHub, Telegram, IP address and website here come from. It was missed on the first pass: X renders a post that long behind a Show more control, and the syndication endpoint the reader uses returns it truncated and says so. It has to be read in a browser. That post also attributes the GitHub account to the Contagious Trader campaign, weaponised cryptocurrency trading bots, citing kmsec's write-up, which is already a source here; this entry carries that label alongside IT Worker Fraud because the researcher makes both claims. This is a second, independent researcher reaching the same conclusion about an identity the lazarus.group registry already records, so the account carries both citations. Two days after the thread that named this operator, the researcher reported that it had rotated to a new persona, 0xcrypoops, and gave the replacement X, GitHub and Telegram accounts. The three are recorded here rather than as a separate persona because the source states outright that they are the same operator continuing. Note that the Telegram handle for the replacement is not a copy of the other two: it begins with the letter o where the X and GitHub handles begin with a zero, and it is transcribed as the post links it.

  x.com/tanuki42_/status/2088278343653413254 — tanuki42 (@tanuki42_) · under “Ming Cheng / hodlwarden / 0xcrypoops / Nikolic Chirag” · published 2026-08-14 · pulled 2026-08-30

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/ming-cheng — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Ming Cheng / Nikolic Chirag / hodlwarden / hodl_warden” · pulled 2026-09-09

hodlwarden.com

domain IT Worker FraudContagious Interview RESEARCHER POST

First seen 2026-08-14 · last seen 2026-08-14

Registration

From the registry’s RDAP record for hodlwarden.com, looked up 2026-10-05.

Source

• The researcher describes interviewing this identity as an applicant for a remote engineering role and assessing them as a North Korean IT worker. The account is presented under the name Ming Cheng. The thread notes a three-year gap in the resume covering 2018 to 2021, which the applicant explained as COVID-19 treatment beginning in 2019, months before the virus was known in China, and says the interview was cut short by a connection problem shortly after the applicant was asked whether he was North Korean. The third post of that thread publishes the whole application under the heading "all the fake details he applied with for anyone tracking", and is where the address, telephone number, GitHub, Telegram, IP address and website here come from. It was missed on the first pass: X renders a post that long behind a Show more control, and the syndication endpoint the reader uses returns it truncated and says so. It has to be read in a browser. That post also attributes the GitHub account to the Contagious Trader campaign, weaponised cryptocurrency trading bots, citing kmsec's write-up, which is already a source here; this entry carries that label alongside IT Worker Fraud because the researcher makes both claims. This is a second, independent researcher reaching the same conclusion about an identity the lazarus.group registry already records, so the account carries both citations. Two days after the thread that named this operator, the researcher reported that it had rotated to a new persona, 0xcrypoops, and gave the replacement X, GitHub and Telegram accounts. The three are recorded here rather than as a separate persona because the source states outright that they are the same operator continuing. Note that the Telegram handle for the replacement is not a copy of the other two: it begins with the letter o where the X and GitHub handles begin with a zero, and it is transcribed as the post links it.

  x.com/tanuki42_/status/2088278349487759785 — tanuki42 (@tanuki42_) · under “Ming Cheng / hodlwarden / 0xcrypoops / Nikolic Chirag” · published 2026-08-14 · pulled 2026-08-30

hodlwarden@gmail.com

email address IT Worker FraudContagious Interview CURATED

First seen 2026-08-14 · last seen 2026-09-24

Sources

• The researcher describes interviewing this identity as an applicant for a remote engineering role and assessing them as a North Korean IT worker. The account is presented under the name Ming Cheng. The thread notes a three-year gap in the resume covering 2018 to 2021, which the applicant explained as COVID-19 treatment beginning in 2019, months before the virus was known in China, and says the interview was cut short by a connection problem shortly after the applicant was asked whether he was North Korean. The third post of that thread publishes the whole application under the heading "all the fake details he applied with for anyone tracking", and is where the address, telephone number, GitHub, Telegram, IP address and website here come from. It was missed on the first pass: X renders a post that long behind a Show more control, and the syndication endpoint the reader uses returns it truncated and says so. It has to be read in a browser. That post also attributes the GitHub account to the Contagious Trader campaign, weaponised cryptocurrency trading bots, citing kmsec's write-up, which is already a source here; this entry carries that label alongside IT Worker Fraud because the researcher makes both claims. This is a second, independent researcher reaching the same conclusion about an identity the lazarus.group registry already records, so the account carries both citations. Two days after the thread that named this operator, the researcher reported that it had rotated to a new persona, 0xcrypoops, and gave the replacement X, GitHub and Telegram accounts. The three are recorded here rather than as a separate persona because the source states outright that they are the same operator continuing. Note that the Telegram handle for the replacement is not a copy of the other two: it begins with the letter o where the X and GitHub handles begin with a zero, and it is transcribed as the post links it.

  x.com/tanuki42_/status/2088278349487759785 — tanuki42 (@tanuki42_) · under “Ming Cheng / hodlwarden / 0xcrypoops / Nikolic Chirag” · published 2026-08-14 · pulled 2026-08-30

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/ming-cheng — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Ming Cheng / Nikolic Chirag / hodlwarden / hodl_warden” · pulled 2026-09-09

• Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 63 commits signed hodlwarden@gmail.com, an address the lazarus.group registry publishes for this persona, to github.com/crypdev007, account id 37245718, created on 10 March 2018, display name crypdev007, with 74 public repositories.

  github.com/crypdev007 — Chollima Hunter · under “Ming Cheng” · pulled 2026-09-24

https://github.com/0xcrypoops

github profile IT Worker FraudContagious Interview RESEARCHER POST removed checked 2026-09-30

First seen 2026-08-16 · last seen 2026-08-16

Source

• The researcher describes interviewing this identity as an applicant for a remote engineering role and assessing them as a North Korean IT worker. The account is presented under the name Ming Cheng. The thread notes a three-year gap in the resume covering 2018 to 2021, which the applicant explained as COVID-19 treatment beginning in 2019, months before the virus was known in China, and says the interview was cut short by a connection problem shortly after the applicant was asked whether he was North Korean. The third post of that thread publishes the whole application under the heading "all the fake details he applied with for anyone tracking", and is where the address, telephone number, GitHub, Telegram, IP address and website here come from. It was missed on the first pass: X renders a post that long behind a Show more control, and the syndication endpoint the reader uses returns it truncated and says so. It has to be read in a browser. That post also attributes the GitHub account to the Contagious Trader campaign, weaponised cryptocurrency trading bots, citing kmsec's write-up, which is already a source here; this entry carries that label alongside IT Worker Fraud because the researcher makes both claims. This is a second, independent researcher reaching the same conclusion about an identity the lazarus.group registry already records, so the account carries both citations. Two days after the thread that named this operator, the researcher reported that it had rotated to a new persona, 0xcrypoops, and gave the replacement X, GitHub and Telegram accounts. The three are recorded here rather than as a separate persona because the source states outright that they are the same operator continuing. Note that the Telegram handle for the replacement is not a copy of the other two: it begins with the letter o where the X and GitHub handles begin with a zero, and it is transcribed as the post links it.

  x.com/tanuki42_/status/2088839296518164599 — tanuki42 (@tanuki42_) · under “Ming Cheng / hodlwarden / 0xcrypoops / Nikolic Chirag” · published 2026-08-16 · pulled 2026-08-30

https://github.com/crypdev007

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-24 · last seen 2026-09-24

live checked 2026-09-30

The image is the avatar this account displays, not evidence of who operates it.

Source

• Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 63 commits signed hodlwarden@gmail.com, an address the lazarus.group registry publishes for this persona, to github.com/crypdev007, account id 37245718, created on 10 March 2018, display name crypdev007, with 74 public repositories.

  github.com/crypdev007 — Chollima Hunter · under “Ming Cheng” · pulled 2026-09-24

https://github.com/hodlwarden

github profile IT Worker FraudContagious Interview RESEARCHER POST removed checked 2026-09-02

First seen 2026-08-14 · last seen 2026-08-14

Sources

• The researcher describes interviewing this identity as an applicant for a remote engineering role and assessing them as a North Korean IT worker. The account is presented under the name Ming Cheng. The thread notes a three-year gap in the resume covering 2018 to 2021, which the applicant explained as COVID-19 treatment beginning in 2019, months before the virus was known in China, and says the interview was cut short by a connection problem shortly after the applicant was asked whether he was North Korean. The third post of that thread publishes the whole application under the heading "all the fake details he applied with for anyone tracking", and is where the address, telephone number, GitHub, Telegram, IP address and website here come from. It was missed on the first pass: X renders a post that long behind a Show more control, and the syndication endpoint the reader uses returns it truncated and says so. It has to be read in a browser. That post also attributes the GitHub account to the Contagious Trader campaign, weaponised cryptocurrency trading bots, citing kmsec's write-up, which is already a source here; this entry carries that label alongside IT Worker Fraud because the researcher makes both claims. This is a second, independent researcher reaching the same conclusion about an identity the lazarus.group registry already records, so the account carries both citations. Two days after the thread that named this operator, the researcher reported that it had rotated to a new persona, 0xcrypoops, and gave the replacement X, GitHub and Telegram accounts. The three are recorded here rather than as a separate persona because the source states outright that they are the same operator continuing. Note that the Telegram handle for the replacement is not a copy of the other two: it begins with the letter o where the X and GitHub handles begin with a zero, and it is transcribed as the post links it.

  x.com/tanuki42_/status/2088278349487759785 — tanuki42 (@tanuki42_) · under “Ming Cheng / hodlwarden / 0xcrypoops / Nikolic Chirag” · published 2026-08-14 · pulled 2026-08-30

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/ming-cheng — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Ming Cheng / Nikolic Chirag / hodlwarden / hodl_warden” · pulled 2026-09-09

https://gitlab.com/hodlwarden

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

• Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. A GitLab account under hodlwarden, one of the logins attributed to this operator, created on 9 April 2026 — months after the reporting that named the handle, which makes it the only account here the operator is known to have opened since being written about. It displays "Hodl Warden", which is the handle spaced out rather than a name, and carries no bio, location or links.

  gitlab.com/hodlwarden — Chollima Hunter · under “Ming Cheng” · pulled 2026-09-12

170.205.31.7

ip address IT Worker FraudContagious Interview RESEARCHER POST

First seen 2026-08-14 · last seen 2026-08-14

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

• The researcher describes interviewing this identity as an applicant for a remote engineering role and assessing them as a North Korean IT worker. The account is presented under the name Ming Cheng. The thread notes a three-year gap in the resume covering 2018 to 2021, which the applicant explained as COVID-19 treatment beginning in 2019, months before the virus was known in China, and says the interview was cut short by a connection problem shortly after the applicant was asked whether he was North Korean. The third post of that thread publishes the whole application under the heading "all the fake details he applied with for anyone tracking", and is where the address, telephone number, GitHub, Telegram, IP address and website here come from. It was missed on the first pass: X renders a post that long behind a Show more control, and the syndication endpoint the reader uses returns it truncated and says so. It has to be read in a browser. That post also attributes the GitHub account to the Contagious Trader campaign, weaponised cryptocurrency trading bots, citing kmsec's write-up, which is already a source here; this entry carries that label alongside IT Worker Fraud because the researcher makes both claims. This is a second, independent researcher reaching the same conclusion about an identity the lazarus.group registry already records, so the account carries both citations. Two days after the thread that named this operator, the researcher reported that it had rotated to a new persona, 0xcrypoops, and gave the replacement X, GitHub and Telegram accounts. The three are recorded here rather than as a separate persona because the source states outright that they are the same operator continuing. Note that the Telegram handle for the replacement is not a copy of the other two: it begins with the letter o where the X and GitHub handles begin with a zero, and it is transcribed as the post links it.

  x.com/tanuki42_/status/2088278349487759785 — tanuki42 (@tanuki42_) · under “Ming Cheng / hodlwarden / 0xcrypoops / Nikolic Chirag” · published 2026-08-14 · pulled 2026-08-30

+17745166548

phone number IT Worker FraudContagious Interview RESEARCHER POST

First seen 2026-08-14 · last seen 2026-08-14

Line type

Sinch is a communications-platform provider selling programmable numbers to software, not a consumer mobile operator, so the wireless label describes the numbering range rather than a handset somebody walked into a shop to buy.

Looked up 2026-09-13 at localcallingguide.com and phonevalidator.com. This is a lookup of the line itself.

Sources

• The researcher describes interviewing this identity as an applicant for a remote engineering role and assessing them as a North Korean IT worker. The account is presented under the name Ming Cheng. The thread notes a three-year gap in the resume covering 2018 to 2021, which the applicant explained as COVID-19 treatment beginning in 2019, months before the virus was known in China, and says the interview was cut short by a connection problem shortly after the applicant was asked whether he was North Korean. The third post of that thread publishes the whole application under the heading "all the fake details he applied with for anyone tracking", and is where the address, telephone number, GitHub, Telegram, IP address and website here come from. It was missed on the first pass: X renders a post that long behind a Show more control, and the syndication endpoint the reader uses returns it truncated and says so. It has to be read in a browser. That post also attributes the GitHub account to the Contagious Trader campaign, weaponised cryptocurrency trading bots, citing kmsec's write-up, which is already a source here; this entry carries that label alongside IT Worker Fraud because the researcher makes both claims. This is a second, independent researcher reaching the same conclusion about an identity the lazarus.group registry already records, so the account carries both citations. Two days after the thread that named this operator, the researcher reported that it had rotated to a new persona, 0xcrypoops, and gave the replacement X, GitHub and Telegram accounts. The three are recorded here rather than as a separate persona because the source states outright that they are the same operator continuing. Note that the Telegram handle for the replacement is not a copy of the other two: it begins with the letter o where the X and GitHub handles begin with a zero, and it is transcribed as the post links it.

  x.com/tanuki42_/status/2088278349487759785 — tanuki42 (@tanuki42_) · under “Ming Cheng / hodlwarden / 0xcrypoops / Nikolic Chirag” · published 2026-08-14 · pulled 2026-08-30

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/ming-cheng — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Ming Cheng / Nikolic Chirag / hodlwarden / hodl_warden” · pulled 2026-09-09

https://t.me/hodlwarden

telegram account IT Worker FraudContagious Interview RESEARCHER POST live checked 2026-11-08

First seen 2026-08-14 · last seen 2026-08-14

Sources

• The researcher describes interviewing this identity as an applicant for a remote engineering role and assessing them as a North Korean IT worker. The account is presented under the name Ming Cheng. The thread notes a three-year gap in the resume covering 2018 to 2021, which the applicant explained as COVID-19 treatment beginning in 2019, months before the virus was known in China, and says the interview was cut short by a connection problem shortly after the applicant was asked whether he was North Korean. The third post of that thread publishes the whole application under the heading "all the fake details he applied with for anyone tracking", and is where the address, telephone number, GitHub, Telegram, IP address and website here come from. It was missed on the first pass: X renders a post that long behind a Show more control, and the syndication endpoint the reader uses returns it truncated and says so. It has to be read in a browser. That post also attributes the GitHub account to the Contagious Trader campaign, weaponised cryptocurrency trading bots, citing kmsec's write-up, which is already a source here; this entry carries that label alongside IT Worker Fraud because the researcher makes both claims. This is a second, independent researcher reaching the same conclusion about an identity the lazarus.group registry already records, so the account carries both citations. Two days after the thread that named this operator, the researcher reported that it had rotated to a new persona, 0xcrypoops, and gave the replacement X, GitHub and Telegram accounts. The three are recorded here rather than as a separate persona because the source states outright that they are the same operator continuing. Note that the Telegram handle for the replacement is not a copy of the other two: it begins with the letter o where the X and GitHub handles begin with a zero, and it is transcribed as the post links it.

  x.com/tanuki42_/status/2088278349487759785 — tanuki42 (@tanuki42_) · under “Ming Cheng / hodlwarden / 0xcrypoops / Nikolic Chirag” · published 2026-08-14 · pulled 2026-08-30

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/ming-cheng — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Ming Cheng / Nikolic Chirag / hodlwarden / hodl_warden” · pulled 2026-09-09

https://t.me/oxcrypoops

telegram account IT Worker FraudContagious Interview RESEARCHER POST live checked 2026-11-08

First seen 2026-08-16 · last seen 2026-08-16

Source

• The researcher describes interviewing this identity as an applicant for a remote engineering role and assessing them as a North Korean IT worker. The account is presented under the name Ming Cheng. The thread notes a three-year gap in the resume covering 2018 to 2021, which the applicant explained as COVID-19 treatment beginning in 2019, months before the virus was known in China, and says the interview was cut short by a connection problem shortly after the applicant was asked whether he was North Korean. The third post of that thread publishes the whole application under the heading "all the fake details he applied with for anyone tracking", and is where the address, telephone number, GitHub, Telegram, IP address and website here come from. It was missed on the first pass: X renders a post that long behind a Show more control, and the syndication endpoint the reader uses returns it truncated and says so. It has to be read in a browser. That post also attributes the GitHub account to the Contagious Trader campaign, weaponised cryptocurrency trading bots, citing kmsec's write-up, which is already a source here; this entry carries that label alongside IT Worker Fraud because the researcher makes both claims. This is a second, independent researcher reaching the same conclusion about an identity the lazarus.group registry already records, so the account carries both citations. Two days after the thread that named this operator, the researcher reported that it had rotated to a new persona, 0xcrypoops, and gave the replacement X, GitHub and Telegram accounts. The three are recorded here rather than as a separate persona because the source states outright that they are the same operator continuing. Note that the Telegram handle for the replacement is not a copy of the other two: it begins with the letter o where the X and GitHub handles begin with a zero, and it is transcribed as the post links it.

  x.com/tanuki42_/status/2088839296518164599 — tanuki42 (@tanuki42_) · under “Ming Cheng / hodlwarden / 0xcrypoops / Nikolic Chirag” · published 2026-08-16 · pulled 2026-08-30

https://x.com/0xcrypoops

x account IT Worker FraudContagious Interview RESEARCHER POST

First seen 2026-08-16 · last seen 2026-08-16

Source

• The researcher describes interviewing this identity as an applicant for a remote engineering role and assessing them as a North Korean IT worker. The account is presented under the name Ming Cheng. The thread notes a three-year gap in the resume covering 2018 to 2021, which the applicant explained as COVID-19 treatment beginning in 2019, months before the virus was known in China, and says the interview was cut short by a connection problem shortly after the applicant was asked whether he was North Korean. The third post of that thread publishes the whole application under the heading "all the fake details he applied with for anyone tracking", and is where the address, telephone number, GitHub, Telegram, IP address and website here come from. It was missed on the first pass: X renders a post that long behind a Show more control, and the syndication endpoint the reader uses returns it truncated and says so. It has to be read in a browser. That post also attributes the GitHub account to the Contagious Trader campaign, weaponised cryptocurrency trading bots, citing kmsec's write-up, which is already a source here; this entry carries that label alongside IT Worker Fraud because the researcher makes both claims. This is a second, independent researcher reaching the same conclusion about an identity the lazarus.group registry already records, so the account carries both citations. Two days after the thread that named this operator, the researcher reported that it had rotated to a new persona, 0xcrypoops, and gave the replacement X, GitHub and Telegram accounts. The three are recorded here rather than as a separate persona because the source states outright that they are the same operator continuing. Note that the Telegram handle for the replacement is not a copy of the other two: it begins with the letter o where the X and GitHub handles begin with a zero, and it is transcribed as the post links it.

  x.com/tanuki42_/status/2088839296518164599 — tanuki42 (@tanuki42_) · under “Ming Cheng / hodlwarden / 0xcrypoops / Nikolic Chirag” · published 2026-08-16 · pulled 2026-08-30

https://x.com/hodlwarden

x account IT Worker FraudContagious Interview RESEARCHER POST

First seen 2026-08-14 · last seen 2026-08-14

Sources

• The researcher describes interviewing this identity as an applicant for a remote engineering role and assessing them as a North Korean IT worker. The account is presented under the name Ming Cheng. The thread notes a three-year gap in the resume covering 2018 to 2021, which the applicant explained as COVID-19 treatment beginning in 2019, months before the virus was known in China, and says the interview was cut short by a connection problem shortly after the applicant was asked whether he was North Korean. The third post of that thread publishes the whole application under the heading "all the fake details he applied with for anyone tracking", and is where the address, telephone number, GitHub, Telegram, IP address and website here come from. It was missed on the first pass: X renders a post that long behind a Show more control, and the syndication endpoint the reader uses returns it truncated and says so. It has to be read in a browser. That post also attributes the GitHub account to the Contagious Trader campaign, weaponised cryptocurrency trading bots, citing kmsec's write-up, which is already a source here; this entry carries that label alongside IT Worker Fraud because the researcher makes both claims. This is a second, independent researcher reaching the same conclusion about an identity the lazarus.group registry already records, so the account carries both citations. Two days after the thread that named this operator, the researcher reported that it had rotated to a new persona, 0xcrypoops, and gave the replacement X, GitHub and Telegram accounts. The three are recorded here rather than as a separate persona because the source states outright that they are the same operator continuing. Note that the Telegram handle for the replacement is not a copy of the other two: it begins with the letter o where the X and GitHub handles begin with a zero, and it is transcribed as the post links it.

  x.com/tanuki42_/status/2088278343653413254 — tanuki42 (@tanuki42_) · under “Ming Cheng / hodlwarden / 0xcrypoops / Nikolic Chirag” · published 2026-08-14 · pulled 2026-08-30

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/ming-cheng — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Ming Cheng / Nikolic Chirag / hodlwarden / hodl_warden” · pulled 2026-09-09