An independent researcher describes a months-long engagement with a person assessed as a suspected DPRK IT worker who used the Jason Kwon and Roy Hensley names and the 0xm00n, hightechrun, and bluesky0309 handles. The author posed as a blockchain-startup recruiter, used decoy documents and tracking links, and recorded emails, domains, browser fingerprints, and IP connections associated with the subject. The attribution is presented as the author’s medium-to-high-confidence assessment based on identity reuse, behavior, GitHub links, and prior public research.