Nelo Labhart

A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Nelo Labhart. The attribution is theirs, not this site's.

IT Worker Fraud First reported 2025-12-16 · last reported 2026-04-16

Identifiers attributed to this persona

8 indicators the source attributes to this operator, each with its sources.

IndicatorTypeAccount status
Nelo Labhart alias —
https://github.com/0xnewegg github profile removed checked 2026-10-11
https://github.com/d0sc4u github profile removed checked 2026-09-30
https://t.me/d0sc4u telegram account live checked 2026-11-08
https://t.me/newegger telegram account live checked 2026-11-08
https://x.com/0xnsfwfa x account not checked
https://x.com/d0sc4u x account not checked
https://x.com/tok3ner x account not checked

Nelo Labhart

alias IT Worker Fraud RESEARCHER POST

First seen 2025-12-16 · last seen 2025-12-16

Source

  • Four posts across December 2025 and April 2026 following one member of the team behind HyperbuildX as the persona changes: the first two record the Nelo Labhart persona giving way to d0sc4u, with a web3.career profile under meta0xflip still pointing at a portfolio that had carried Nelo Labhart and 0xopsdev branding; the third names d0sc4u among the North Koreans behind MutantRolls; the fourth gives tok3ner, Nelo Labhart and d0sc4u as one person behind HyperbuildX, spinx_game and MutantRolls, with the GitHub account. The 0xopsdev and HyperbuildX accounts already reach this site from tayvano's research and from ketman.org. Two posts of 16 April 2026 add a fresh set of names. The first quotes a post by the X account 0xnsfwfa, since deleted, that the researcher reads as the same operator back under a new name, and lists d0sc4u, Meta0xFlip, Nelo Labhart and ZireaelGit together; the account's surviving posts promote a Raydium token sniper hosted at github.com/meta0xflip. The second reproduces a commit by the GitHub account 0xnewegg to its discord-betting-lottery-bot repository, authored as 0xNewEgg <nelo.labhart@gmail.com>, that changes the README's Telegram contact from doscau (t.me/d0sc4u) to NewEgg (t.me/newegger). Meta0xFlip and ZireaelGit are listed without a platform and are not recorded here.
    x.com/KawaiiJongUwUn/status/2000755538414477540 — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Nelo Labhart” · published 2025-12-16 · pulled 2026-08-30

https://github.com/0xnewegg

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-10-11

First seen 2026-04-16 · last seen 2026-04-16

Source

  • Four posts across December 2025 and April 2026 following one member of the team behind HyperbuildX as the persona changes: the first two record the Nelo Labhart persona giving way to d0sc4u, with a web3.career profile under meta0xflip still pointing at a portfolio that had carried Nelo Labhart and 0xopsdev branding; the third names d0sc4u among the North Koreans behind MutantRolls; the fourth gives tok3ner, Nelo Labhart and d0sc4u as one person behind HyperbuildX, spinx_game and MutantRolls, with the GitHub account. The 0xopsdev and HyperbuildX accounts already reach this site from tayvano's research and from ketman.org. Two posts of 16 April 2026 add a fresh set of names. The first quotes a post by the X account 0xnsfwfa, since deleted, that the researcher reads as the same operator back under a new name, and lists d0sc4u, Meta0xFlip, Nelo Labhart and ZireaelGit together; the account's surviving posts promote a Raydium token sniper hosted at github.com/meta0xflip. The second reproduces a commit by the GitHub account 0xnewegg to its discord-betting-lottery-bot repository, authored as 0xNewEgg <nelo.labhart@gmail.com>, that changes the README's Telegram contact from doscau (t.me/d0sc4u) to NewEgg (t.me/newegger). Meta0xFlip and ZireaelGit are listed without a platform and are not recorded here.
    x.com/KawaiiJongUwUn/status/2044898029702934686 — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Nelo Labhart” · published 2026-04-16 · pulled 2026-08-30

https://github.com/d0sc4u

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-09-30

First seen 2026-04-10 · last seen 2026-04-10

Source

  • Four posts across December 2025 and April 2026 following one member of the team behind HyperbuildX as the persona changes: the first two record the Nelo Labhart persona giving way to d0sc4u, with a web3.career profile under meta0xflip still pointing at a portfolio that had carried Nelo Labhart and 0xopsdev branding; the third names d0sc4u among the North Koreans behind MutantRolls; the fourth gives tok3ner, Nelo Labhart and d0sc4u as one person behind HyperbuildX, spinx_game and MutantRolls, with the GitHub account. The 0xopsdev and HyperbuildX accounts already reach this site from tayvano's research and from ketman.org. Two posts of 16 April 2026 add a fresh set of names. The first quotes a post by the X account 0xnsfwfa, since deleted, that the researcher reads as the same operator back under a new name, and lists d0sc4u, Meta0xFlip, Nelo Labhart and ZireaelGit together; the account's surviving posts promote a Raydium token sniper hosted at github.com/meta0xflip. The second reproduces a commit by the GitHub account 0xnewegg to its discord-betting-lottery-bot repository, authored as 0xNewEgg <nelo.labhart@gmail.com>, that changes the README's Telegram contact from doscau (t.me/d0sc4u) to NewEgg (t.me/newegger). Meta0xFlip and ZireaelGit are listed without a platform and are not recorded here.
    x.com/KawaiiJongUwUn/status/2042750269453226420 — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Nelo Labhart” · published 2026-04-10 · pulled 2026-08-30

https://t.me/d0sc4u

telegram account IT Worker Fraud RESEARCHER POST live checked 2026-11-08

First seen 2026-04-16 · last seen 2026-04-16

Source

  • Four posts across December 2025 and April 2026 following one member of the team behind HyperbuildX as the persona changes: the first two record the Nelo Labhart persona giving way to d0sc4u, with a web3.career profile under meta0xflip still pointing at a portfolio that had carried Nelo Labhart and 0xopsdev branding; the third names d0sc4u among the North Koreans behind MutantRolls; the fourth gives tok3ner, Nelo Labhart and d0sc4u as one person behind HyperbuildX, spinx_game and MutantRolls, with the GitHub account. The 0xopsdev and HyperbuildX accounts already reach this site from tayvano's research and from ketman.org. Two posts of 16 April 2026 add a fresh set of names. The first quotes a post by the X account 0xnsfwfa, since deleted, that the researcher reads as the same operator back under a new name, and lists d0sc4u, Meta0xFlip, Nelo Labhart and ZireaelGit together; the account's surviving posts promote a Raydium token sniper hosted at github.com/meta0xflip. The second reproduces a commit by the GitHub account 0xnewegg to its discord-betting-lottery-bot repository, authored as 0xNewEgg <nelo.labhart@gmail.com>, that changes the README's Telegram contact from doscau (t.me/d0sc4u) to NewEgg (t.me/newegger). Meta0xFlip and ZireaelGit are listed without a platform and are not recorded here.
    x.com/KawaiiJongUwUn/status/2044898029702934686 — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Nelo Labhart” · published 2026-04-16 · pulled 2026-08-30

https://t.me/newegger

telegram account IT Worker Fraud RESEARCHER POST live checked 2026-11-08

First seen 2026-04-16 · last seen 2026-04-16

Source

  • Four posts across December 2025 and April 2026 following one member of the team behind HyperbuildX as the persona changes: the first two record the Nelo Labhart persona giving way to d0sc4u, with a web3.career profile under meta0xflip still pointing at a portfolio that had carried Nelo Labhart and 0xopsdev branding; the third names d0sc4u among the North Koreans behind MutantRolls; the fourth gives tok3ner, Nelo Labhart and d0sc4u as one person behind HyperbuildX, spinx_game and MutantRolls, with the GitHub account. The 0xopsdev and HyperbuildX accounts already reach this site from tayvano's research and from ketman.org. Two posts of 16 April 2026 add a fresh set of names. The first quotes a post by the X account 0xnsfwfa, since deleted, that the researcher reads as the same operator back under a new name, and lists d0sc4u, Meta0xFlip, Nelo Labhart and ZireaelGit together; the account's surviving posts promote a Raydium token sniper hosted at github.com/meta0xflip. The second reproduces a commit by the GitHub account 0xnewegg to its discord-betting-lottery-bot repository, authored as 0xNewEgg <nelo.labhart@gmail.com>, that changes the README's Telegram contact from doscau (t.me/d0sc4u) to NewEgg (t.me/newegger). Meta0xFlip and ZireaelGit are listed without a platform and are not recorded here.
    x.com/KawaiiJongUwUn/status/2044898029702934686 — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Nelo Labhart” · published 2026-04-16 · pulled 2026-08-30

https://x.com/0xnsfwfa

x account IT Worker Fraud RESEARCHER POST

First seen 2026-04-16 · last seen 2026-04-16

Source

  • Four posts across December 2025 and April 2026 following one member of the team behind HyperbuildX as the persona changes: the first two record the Nelo Labhart persona giving way to d0sc4u, with a web3.career profile under meta0xflip still pointing at a portfolio that had carried Nelo Labhart and 0xopsdev branding; the third names d0sc4u among the North Koreans behind MutantRolls; the fourth gives tok3ner, Nelo Labhart and d0sc4u as one person behind HyperbuildX, spinx_game and MutantRolls, with the GitHub account. The 0xopsdev and HyperbuildX accounts already reach this site from tayvano's research and from ketman.org. Two posts of 16 April 2026 add a fresh set of names. The first quotes a post by the X account 0xnsfwfa, since deleted, that the researcher reads as the same operator back under a new name, and lists d0sc4u, Meta0xFlip, Nelo Labhart and ZireaelGit together; the account's surviving posts promote a Raydium token sniper hosted at github.com/meta0xflip. The second reproduces a commit by the GitHub account 0xnewegg to its discord-betting-lottery-bot repository, authored as 0xNewEgg <nelo.labhart@gmail.com>, that changes the README's Telegram contact from doscau (t.me/d0sc4u) to NewEgg (t.me/newegger). Meta0xFlip and ZireaelGit are listed without a platform and are not recorded here.
    x.com/KawaiiJongUwUn/status/2044897076006334927 — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Nelo Labhart” · published 2026-04-16 · pulled 2026-08-30

https://x.com/d0sc4u

x account IT Worker Fraud RESEARCHER POST

First seen 2025-12-16 · last seen 2025-12-16

Source

  • Four posts across December 2025 and April 2026 following one member of the team behind HyperbuildX as the persona changes: the first two record the Nelo Labhart persona giving way to d0sc4u, with a web3.career profile under meta0xflip still pointing at a portfolio that had carried Nelo Labhart and 0xopsdev branding; the third names d0sc4u among the North Koreans behind MutantRolls; the fourth gives tok3ner, Nelo Labhart and d0sc4u as one person behind HyperbuildX, spinx_game and MutantRolls, with the GitHub account. The 0xopsdev and HyperbuildX accounts already reach this site from tayvano's research and from ketman.org. Two posts of 16 April 2026 add a fresh set of names. The first quotes a post by the X account 0xnsfwfa, since deleted, that the researcher reads as the same operator back under a new name, and lists d0sc4u, Meta0xFlip, Nelo Labhart and ZireaelGit together; the account's surviving posts promote a Raydium token sniper hosted at github.com/meta0xflip. The second reproduces a commit by the GitHub account 0xnewegg to its discord-betting-lottery-bot repository, authored as 0xNewEgg <nelo.labhart@gmail.com>, that changes the README's Telegram contact from doscau (t.me/d0sc4u) to NewEgg (t.me/newegger). Meta0xFlip and ZireaelGit are listed without a platform and are not recorded here.
    x.com/KawaiiJongUwUn/status/2000756520015777954 — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Nelo Labhart” · published 2025-12-16 · pulled 2026-08-30

https://x.com/tok3ner

x account IT Worker Fraud RESEARCHER POST

First seen 2026-04-10 · last seen 2026-04-10

Source

  • Four posts across December 2025 and April 2026 following one member of the team behind HyperbuildX as the persona changes: the first two record the Nelo Labhart persona giving way to d0sc4u, with a web3.career profile under meta0xflip still pointing at a portfolio that had carried Nelo Labhart and 0xopsdev branding; the third names d0sc4u among the North Koreans behind MutantRolls; the fourth gives tok3ner, Nelo Labhart and d0sc4u as one person behind HyperbuildX, spinx_game and MutantRolls, with the GitHub account. The 0xopsdev and HyperbuildX accounts already reach this site from tayvano's research and from ketman.org. Two posts of 16 April 2026 add a fresh set of names. The first quotes a post by the X account 0xnsfwfa, since deleted, that the researcher reads as the same operator back under a new name, and lists d0sc4u, Meta0xFlip, Nelo Labhart and ZireaelGit together; the account's surviving posts promote a Raydium token sniper hosted at github.com/meta0xflip. The second reproduces a commit by the GitHub account 0xnewegg to its discord-betting-lottery-bot repository, authored as 0xNewEgg <nelo.labhart@gmail.com>, that changes the README's Telegram contact from doscau (t.me/d0sc4u) to NewEgg (t.me/newegger). Meta0xFlip and ZireaelGit are listed without a platform and are not recorded here.
    x.com/KawaiiJongUwUn/status/2042750269453226420 — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Nelo Labhart” · published 2026-04-10 · pulled 2026-08-30

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Nelo Labhart as the name of the operator is the cited researcher’s assertion, repeated here as their claim.