The best-known member of Elon Musk’s so-called “department of government efficiency” (Doge) service team of technologists once supported a cybercrime gang that boasted about selling stolen data and cyberstalking an FBI agent, according to digital records reviewed by Reuters.

Edward Coristine is a prominent member of the Doge effort, which has been given extensive access to official networks with the goal of significantly downsizing the US government. This initiative is led by Musk, known as the world’s richest person, under the powerful endorsement of Donald Trump.

Past reports have focused on Coristine’s youth — he is 19 years old — and his unconventional nickname “bigballs,” which became a cultural reference point. Musk has publicly endorsed the teen on his social media platform X, praising him as “awesome.”

Starting around 2022, while still in high school, Coristine operated a company called DiamondCDN that provided network services, as shown by corporate and digital records reviewed by Reuters and interviews with former associates. Among its clients was a website run by a group of cybercriminals known as “EGodly.” The details of Coristine’s involvement with EGodly have not been previously reported.

On February 15, 2023, EGodly expressed gratitude to Coristine’s company on the Telegram messaging app for its support in safeguarding their operations.

Digital records showed that the EGodly website, dataleak.fun, was linked to internet protocol addresses registered to DiamondCDN and other Coristine-owned entities between October 2022 and June 2023. Visitors attempting to access the site during that period might have encountered a “security check” from DiamondCDN.

Neither Coristine nor Musk’s team, which is not an official government department, responded to inquiries for this story. Nonetheless, Coristine is listed as a “senior adviser” at both the US state department and the Cybersecurity and Infrastructure Security Agency (CISA), according to sources within the organizations.

EGodly ceased activity over the past year; attempts to reach individuals linked to the group proved unsuccessful.

DiamondCDN marketed itself as providing “excellent security tools” to reduce “infrastructure costs” without inspecting user content, as reflected in archived copies of the site.

That year, EGodly publicized unlawful activities, including phone number hijacking, breaching specific law enforcement email accounts in Latin America and Eastern Europe, and cryptocurrency theft.

EGodly also released sensitive details of an FBI agent who was investigating them, including personal contact information, photos of his home, and even recorded an obscene call to his number. They also posted a video from a car driving past the agent’s house in Delaware, harassing him with shouts.

Reuters could not verify EGodly’s claims of criminal activity independently but confirmed the video by visiting the agent’s former address and comparing it to the footage.

The targeted FBI agent, now retired, acknowledged that EGodly’s connection to swatting had attracted law enforcement’s attention, but declined to share further details while expressing concern for retaliation. The FBI would not comment on EGodly or related investigations.

It remains unclear how long EGodly used DiamondCDN’s services or whether they paid for them. DiamondCDN’s website indicated they planned to have both paying and nonpaying clients.

Furthermore, individuals who have experienced EGodly’s abuse and a cybercrime researcher familiar with the group described it as being composed of seasoned fraudsters, affirming the validity of their claims. Both sources expressed fear of retaliation and wished to remain anonymous.

Nitin Natarajan, a former deputy director of CISA under the Biden administration, stated concern over Coristine’s recent association with such a group, especially given their access to government networks.