An on-chain researcher documented a suspected DPRK IT worker who applied as "Ming Cheng" using the hodlwarden persona and supplied inconsistent employment and location details. The researcher linked the hodlwarden GitHub account to the Contagious Trader campaign, which uses weaponized cryptocurrency trading bots. The reported identity used 170.205.31.7, [email protected], and hodlwarden.com, then rotated to a new 0xcrypoops persona after the thread was published. The researcher also said four companies had been notified about DPRK IT workers on their payroll and ten additional personas had been added to the tracking project.