Chollima Hunter

← All personas

Steven Leal

Also reported as: Mitsuru KudoPiaosteven228312Lucky PennyLovelyBTCBTC415

A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below was filed under the heading “Steven Leal / Mitsuru Kudo” by the report that documented it.

IT Worker Fraud First reported 2025-07-30 · last reported 2026-10-18

LinkedIn accounts

Identifiers reported alongside

21 indicators filed under the same heading, each with its sources.

IndicatorTypeAccount status
LovelyBTC alias —
Lucky Penny alias —
Piao alias —
Steven Leal alias —
https://dev.to/btc415 devto account not checked
https://dev.to/dodger213 devto account not checked
https://dev.to/steven228312 devto account removed checked 2026-11-08
klaus237192@gmail.com email address —
mitsurukudo213@gmail.com email address —
steven0822dev@gmail.com email address —
steven228312@gmail.com email address —
stevenpiao0822@gmail.com email address —
https://github.com/luckypenny1632 github profile removed checked 2026-09-02
https://github.com/luckypenny1632333 github profile live checked 2026-09-30
https://github.com/steven228312 github profile removed checked 2026-09-30
https://github.com/stevendev0822 github profile removed checked 2026-09-30
+14706212757 phone number —
https://t.me/dodger0213 telegram account not checked
https://t.me/steven228312 telegram account live checked 2026-11-08
https://t.me/stevendev0822 telegram account not checked
https://x.com/steven228312 x account not checked

LovelyBTC

alias IT Worker Fraud RESEARCHER POST

First seen 2025-07-30 · last seen 2025-07-30

Source

  • The post lists alenschmitt415@gmail.com and mitsurukudo213@gmail.com under a heading of 'Unattrib', meaning the researcher did not tie them to this persona. They are recorded on the unattributed entry rather than here.
    x.com/browsercookies/status/1950686957748834390 — Cookie Connoisseur (@browsercookies) · under “Steven Leal / Piao / steven228312 / Lucky Penny / LovelyBTC / BTC415” · published 2025-07-30 · pulled 2026-08-30

Lucky Penny

alias IT Worker Fraud RESEARCHER POST

First seen 2025-07-30 · last seen 2025-07-30

Source

  • The post lists alenschmitt415@gmail.com and mitsurukudo213@gmail.com under a heading of 'Unattrib', meaning the researcher did not tie them to this persona. They are recorded on the unattributed entry rather than here.
    x.com/browsercookies/status/1950686957748834390 — Cookie Connoisseur (@browsercookies) · under “Steven Leal / Piao / steven228312 / Lucky Penny / LovelyBTC / BTC415” · published 2025-07-30 · pulled 2026-08-30

Piao

alias IT Worker Fraud RESEARCHER POST

First seen 2025-07-30 · last seen 2025-07-30

Source

  • The post lists alenschmitt415@gmail.com and mitsurukudo213@gmail.com under a heading of 'Unattrib', meaning the researcher did not tie them to this persona. They are recorded on the unattributed entry rather than here.
    x.com/browsercookies/status/1950686957748834390 — Cookie Connoisseur (@browsercookies) · under “Steven Leal / Piao / steven228312 / Lucky Penny / LovelyBTC / BTC415” · published 2025-07-30 · pulled 2026-08-30

Steven Leal

alias IT Worker Fraud CURATED

First seen 2025-07-30 · last seen 2026-09-29

Sources

  • The post lists alenschmitt415@gmail.com and mitsurukudo213@gmail.com under a heading of 'Unattrib', meaning the researcher did not tie them to this persona. They are recorded on the unattributed entry rather than here.
    x.com/browsercookies/status/1950686957748834390 — Cookie Connoisseur (@browsercookies) · under “Steven Leal / Piao / steven228312 / Lucky Penny / LovelyBTC / BTC415” · published 2025-07-30 · pulled 2026-08-30
  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/luckypenny1632333 is account id 177725156, created on 7 August 2024, display name Lucky Penny, bio Sr. Software Engineer, location Hong Kong. All 100 of its own commits in GitHub's search are signed stevenpiao0822@gmail.com, an address browsercookies gives for Steven Leal. Three commits in its repositories are signed alenschmitt415@gmail.com, which the account filed under Mark Santiago, github.com/marksantiago290, also commits with.
    github.com/luckypenny1632333 — Chollima Hunter · under “Steven Leal” · pulled 2026-09-24
  • Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (luckypenny1632) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
    github.com/katlogic/solana-trading-bot/blob/0604df653106bb168a0c7b9d4c58f17c8d5fdaaf/README.md — Chollima Hunter · under “Steven Leal” · published 2026-02-26 · pulled 2026-09-29

https://dev.to/btc415

devto account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as btc415

First seen 2026-09-29 · last seen 2026-10-18

Source

  • …BTC415 and luckypenny1632333 * As such, also used by Mark Limuel Santiago * DEV Community 1: https://dev.to/dodger213 * DEV Community 2: https://dev.to/btc415 * Also linked to BTC415 used by Mark Limuel Santiago * Bio states, "Technical Co-founder of TAOI" * Telegram 1:…
    Post-Minions assessment — Kawaii-Jong-UwUn (GitHub research) · under “Steven Leal / Mitsuru Kudo” · published 2025-07-26 · pulled 2026-09-29

https://dev.to/dodger213

devto account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as dodger213

First seen 2026-09-29 · last seen 2026-10-18

Source

  • …* Same profile photo as BTC415 and luckypenny1632333 * As such, also used by Mark Limuel Santiago * DEV Community 1: https://dev.to/dodger213 * DEV Community 2: https://dev.to/btc415 * Also linked to BTC415 used by Mark Limuel Santiago * Bio states, "Technical Co-founder of…
    Post-Minions assessment — Kawaii-Jong-UwUn (GitHub research) · under “Steven Leal / Mitsuru Kudo” · published 2025-07-26 · pulled 2026-09-29

https://dev.to/steven228312

devto account IT Worker Fraud RESEARCHER POST removed checked 2026-11-08

First seen 2025-07-30 · last seen 2025-07-30

Source

  • The post lists alenschmitt415@gmail.com and mitsurukudo213@gmail.com under a heading of 'Unattrib', meaning the researcher did not tie them to this persona. They are recorded on the unattributed entry rather than here.
    x.com/browsercookies/status/1950686957748834390 — Cookie Connoisseur (@browsercookies) · under “Steven Leal / Piao / steven228312 / Lucky Penny / LovelyBTC / BTC415” · published 2025-07-30 · pulled 2026-08-30

klaus237192@gmail.com

email address IT Worker Fraud CURATED

First seen 2026-09-29 · last seen 2026-09-29

Source

  • Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (luckypenny1632) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
    github.com/katlogic/solana-trading-bot/blob/0604df653106bb168a0c7b9d4c58f17c8d5fdaaf/README.md — Chollima Hunter · under “Steven Leal” · published 2026-02-26 · pulled 2026-09-29

mitsurukudo213@gmail.com

email address IT Worker Fraud CURATED

First seen 2025-07-30 · last seen 2026-10-18

Sources

  • x.com/browsercookies/status/1950686957748834390 — Cookie Connoisseur (@browsercookies) · under “Unattributed” · published 2025-07-30 · pulled 2026-08-30
  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 100 commits signed mitsurukudo213@gmail.com, an address browsercookies listed under the heading Unattrib in a post about Steven Leal, without tying it to that persona, to github.com/golden0x, account id 226656211, created on 15 August 2025, display name Golden Ox, with 3 public repositories.
    github.com/golden0x — Chollima Hunter · under “A GitHub account holding an address browsercookies listed as Unattrib beside Steven Leal” · pulled 2026-09-24

  • Nearby text:

    …of TAOI" * Telegram 1: https://t.me/stevendev0822 * Telegram 2: https://t.me/dodger0213 * Email 1: stevenpiao0822@gmail.com * Email 2: mitsurukudo213@gmail.com * Email 3: steven0822.dev@gmail.com * Twitter: https://x.com/steven228312 * LinkedIn: https://www.linkedin.com/in/steven-leal-183252338/ *…
    Post-Minions assessment — Kawaii-Jong-UwUn (GitHub research) · under “Steven Leal / Mitsuru Kudo” · published 2025-07-26 · pulled 2026-09-29

steven0822dev@gmail.com

email address IT Worker Fraud MATCHED IN SOURCE

Listed as steven0822.dev@gmail.com

First seen 2026-09-29 · last seen 2026-10-18

Source

  • Nearby text:

    …Telegram 2: https://t.me/dodger0213 * Email 1: stevenpiao0822@gmail.com * Email 2: mitsurukudo213@gmail.com * Email 3: steven0822.dev@gmail.com * Twitter: https://x.com/steven228312 * LinkedIn: https://www.linkedin.com/in/steven-leal-183252338/ * Instagram:…
    Post-Minions assessment — Kawaii-Jong-UwUn (GitHub research) · under “Steven Leal / Mitsuru Kudo” · published 2025-07-26 · pulled 2026-09-29

steven228312@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-07-30 · last seen 2025-07-30

Source

  • The post lists alenschmitt415@gmail.com and mitsurukudo213@gmail.com under a heading of 'Unattrib', meaning the researcher did not tie them to this persona. They are recorded on the unattributed entry rather than here.
    x.com/browsercookies/status/1950686957748834390 — Cookie Connoisseur (@browsercookies) · under “Steven Leal / Piao / steven228312 / Lucky Penny / LovelyBTC / BTC415” · published 2025-07-30 · pulled 2026-08-30

stevenpiao0822@gmail.com

email address IT Worker Fraud CURATED

First seen 2025-07-30 · last seen 2026-10-18

Sources

  • The post lists alenschmitt415@gmail.com and mitsurukudo213@gmail.com under a heading of 'Unattrib', meaning the researcher did not tie them to this persona. They are recorded on the unattributed entry rather than here.
    x.com/browsercookies/status/1950686957748834390 — Cookie Connoisseur (@browsercookies) · under “Steven Leal / Piao / steven228312 / Lucky Penny / LovelyBTC / BTC415” · published 2025-07-30 · pulled 2026-08-30
  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/luckypenny1632333 is account id 177725156, created on 7 August 2024, display name Lucky Penny, bio Sr. Software Engineer, location Hong Kong. All 100 of its own commits in GitHub's search are signed stevenpiao0822@gmail.com, an address browsercookies gives for Steven Leal. Three commits in its repositories are signed alenschmitt415@gmail.com, which the account filed under Mark Santiago, github.com/marksantiago290, also commits with.
    github.com/luckypenny1632333 — Chollima Hunter · under “Steven Leal” · pulled 2026-09-24

  • Nearby text:

    …* Bio states, "Technical Co-founder of TAOI" * Telegram 1: https://t.me/stevendev0822 * Telegram 2: https://t.me/dodger0213 * Email 1: stevenpiao0822@gmail.com * Email 2: mitsurukudo213@gmail.com * Email 3: steven0822.dev@gmail.com * Twitter: https://x.com/steven228312 * LinkedIn:…
    Post-Minions assessment — Kawaii-Jong-UwUn (GitHub research) · under “Steven Leal / Mitsuru Kudo” · published 2025-07-26 · pulled 2026-09-29

https://github.com/luckypenny1632

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-09-02

First seen 2025-07-30 · last seen 2025-07-30

Source

  • The post lists alenschmitt415@gmail.com and mitsurukudo213@gmail.com under a heading of 'Unattrib', meaning the researcher did not tie them to this persona. They are recorded on the unattributed entry rather than here.
    x.com/browsercookies/status/1950686957748834390 — Cookie Connoisseur (@browsercookies) · under “Steven Leal / Piao / steven228312 / Lucky Penny / LovelyBTC / BTC415” · published 2025-07-30 · pulled 2026-08-30

https://github.com/luckypenny1632333

github profile IT Worker Fraud CURATED live checked 2026-09-30

Listed as luckypenny1632333

First seen 2026-09-24 · last seen 2026-10-18

Sources

  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/luckypenny1632333 is account id 177725156, created on 7 August 2024, display name Lucky Penny, bio Sr. Software Engineer, location Hong Kong. All 100 of its own commits in GitHub's search are signed stevenpiao0822@gmail.com, an address browsercookies gives for Steven Leal. Three commits in its repositories are signed alenschmitt415@gmail.com, which the account filed under Mark Santiago, github.com/marksantiago290, also commits with.
    github.com/luckypenny1632333 — Chollima Hunter · under “Steven Leal” · pulled 2026-09-24
  • …* Profile photo matches marksantiago02 * Also used by Steven Leal * GitHub 3: https://github.com/luckypenny1632333 * Display Name: Lucky Penny * Also linked to BTC415 used by Steven Leal * Portfolio: https://marksantiago.top/ * Twitter:…
    Post-Minions assessment — Kawaii-Jong-UwUn (GitHub research) · under “Mark Limuel Santiago” · published 2025-07-26 · pulled 2026-09-29

https://github.com/steven228312

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-09-02

Listed as steven228312

First seen 2025-07-30 · last seen 2026-10-18

Sources

  • The post lists alenschmitt415@gmail.com and mitsurukudo213@gmail.com under a heading of 'Unattrib', meaning the researcher did not tie them to this persona. They are recorded on the unattributed entry rather than here.
    x.com/browsercookies/status/1950686957748834390 — Cookie Connoisseur (@browsercookies) · under “Steven Leal / Piao / steven228312 / Lucky Penny / LovelyBTC / BTC415” · published 2025-07-30 · pulled 2026-08-30

  • Nearby text:

    …Telegram: https://t.me/marksantiago02 * Email: marksantiago0929@gmail.com ----------------- ### Steven Leal / Mitsuru Kudo * GitHub 1: https://github.com/steven228312 * GitHub 2: https://github.com/luckypenny1632333 GitHub 3: https://github.com/stevendev0822 * Portfolio 1:…
    Post-Minions assessment — Kawaii-Jong-UwUn (GitHub research) · under “Steven Leal / Mitsuru Kudo” · published 2025-07-26 · pulled 2026-09-29

https://github.com/stevendev0822

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-09-30

Listed as stevendev0822

First seen 2026-09-29 · last seen 2026-10-18

Source

  • Nearby text:

    …Steven Leal / Mitsuru Kudo * GitHub 1: https://github.com/steven228312 * GitHub 2: https://github.com/luckypenny1632333 GitHub 3: https://github.com/stevendev0822 * Portfolio 1: https://steven-dev.vercel.app/ * Portfolio 2: https://mitsuru-kudo-blockchain-portfolio.vercel.app/ * Resume:…
    Post-Minions assessment — Kawaii-Jong-UwUn (GitHub research) · under “Steven Leal / Mitsuru Kudo” · published 2025-07-26 · pulled 2026-09-29

+14706212757

phone number IT Worker Fraud MATCHED IN SOURCE

First seen 2026-10-18 · last seen 2026-10-18

Source

  • Nearby text:

    …https://x.com/steven228312 * LinkedIn: https://www.linkedin.com/in/steven-leal-183252338/ * Instagram: instagram.com/steven228312 * Phone: +1 (470) 621 2757 ----------------- ### Sebastian Robinson * GitHub: https://github.com/BinaryBard-0604 * Portfolio:…
    Post-Minions assessment — Kawaii-Jong-UwUn (GitHub research) · under “Steven Leal / Mitsuru Kudo” · published 2025-07-26 · pulled 2026-10-18

https://t.me/dodger0213

telegram account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as dodger0213

First seen 2026-09-29 · last seen 2026-10-18

Source

  • Nearby text:

    …BTC415 used by Mark Limuel Santiago * Bio states, "Technical Co-founder of TAOI" * Telegram 1: https://t.me/stevendev0822 * Telegram 2: https://t.me/dodger0213 * Email 1: stevenpiao0822@gmail.com * Email 2: mitsurukudo213@gmail.com * Email 3: steven0822.dev@gmail.com * Twitter:…
    Post-Minions assessment — Kawaii-Jong-UwUn (GitHub research) · under “Steven Leal / Mitsuru Kudo” · published 2025-07-26 · pulled 2026-09-29

https://t.me/steven228312

telegram account IT Worker Fraud RESEARCHER POST live checked 2026-11-08

First seen 2025-07-30 · last seen 2025-07-30

Source

  • The post lists alenschmitt415@gmail.com and mitsurukudo213@gmail.com under a heading of 'Unattrib', meaning the researcher did not tie them to this persona. They are recorded on the unattributed entry rather than here.
    x.com/browsercookies/status/1950686957748834390 — Cookie Connoisseur (@browsercookies) · under “Steven Leal / Piao / steven228312 / Lucky Penny / LovelyBTC / BTC415” · published 2025-07-30 · pulled 2026-08-30

https://t.me/stevendev0822

telegram account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as stevendev0822

First seen 2026-09-29 · last seen 2026-10-18

Source

  • Nearby text:

    …2: https://dev.to/btc415 * Also linked to BTC415 used by Mark Limuel Santiago * Bio states, "Technical Co-founder of TAOI" * Telegram 1: https://t.me/stevendev0822 * Telegram 2: https://t.me/dodger0213 * Email 1: stevenpiao0822@gmail.com * Email 2: mitsurukudo213@gmail.com * Email 3:…
    Post-Minions assessment — Kawaii-Jong-UwUn (GitHub research) · under “Steven Leal / Mitsuru Kudo” · published 2025-07-26 · pulled 2026-09-29

https://x.com/steven228312

x account IT Worker Fraud RESEARCHER POST

First seen 2025-07-30 · last seen 2025-07-30

Source

  • The post lists alenschmitt415@gmail.com and mitsurukudo213@gmail.com under a heading of 'Unattrib', meaning the researcher did not tie them to this persona. They are recorded on the unattributed entry rather than here.
    x.com/browsercookies/status/1950686957748834390 — Cookie Connoisseur (@browsercookies) · under “Steven Leal / Piao / steven228312 / Lucky Penny / LovelyBTC / BTC415” · published 2025-07-30 · pulled 2026-08-30

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Steven Leal is the name an account presented under, not established to be the name of its operator.