Edward Coristine

Coristine held concurrent access credentials across at least nine federal agencies as a DOGE "Expert" without undergoing the standard background check process that would have surfaced his firing from Path Network and his documented associations with cybercrime infrastructure ¹. His GSA clearance was at the A-suite tier, granting access to all physical spaces and IT systems across that agency, while at CISA he held a DHS email address and network access ¹. The breadth of simultaneous access — OPM, CISA, State Department, DHS, FEMA, GSA, HHS, USAID, and the Department of Education — is documented in ProPublica's DOGE tracker, which also notes that Coristine filed no financial disclosure at any point during his government service ¹.

At the Department of Education, DOGE personnel including Coristine accessed databases containing Social Security numbers and bank account records for approximately 43 million student loan borrowers; that data was subsequently routed into Microsoft Azure AI systems ¹. Federal court filings addressed the Education Department access specifically ¹. The Senate HSGAC report authored by Senator Peters (September 2025) identified Coristine by name as an example of a DOGE staffer with a documented data-mishandling history who nonetheless received unrestricted access to SSA systems when he transitioned there in June 2025 ⁷.

At OPM, Coristine reported to Aram Moghaddassi's chain of command through Amanda Scales, the OPM Chief of Staff and former xAI employee ⁴. At the SSA, Moghaddassi — serving as CIO — granted Coristine and other DOGE-affiliated personnel access to USCIS immigration databases Connection #3257. Coristine's tenure as a full-time government employee began in May 2025 and his formal SSA assignment commenced June 2025 ⁷.

Path Network CEO Marshal Webb had internally advocated against firing Coristine from his cybersecurity internship, reasoning that doing so would make him "an enemy" ². The June 2022 termination proceeded regardless, with an executive confirming in writing that Coristine had been "terminated for leaking internal information to the competitors" ². Within two months of the termination, Coristine posted in a Discord channel under the alias "Rivage" that he had retained access to Path Network's game-hosting machines for months after being let go ². A large collection of internal Path Network documents was subsequently leaked online ².

On August 23, 2022 — approximately two months after the Path Network firing — Coristine registered DiamondCDN LLC at 26 Lakeview Ave, New Canaan, Connecticut (entity #920 in the investigation database) ³. From October 2022 through June 2023, DiamondCDN provided CDN hosting and DDoS-protection infrastructure to EGodly, a cybercrime group that publicly claimed responsibility for phone number hijacking, trafficking stolen PII, hacking law enforcement email accounts, and an extended harassment campaign against an FBI agent in Wilmington, Delaware that included distributing his home address, posting photographs of his residence, and conducting physical surveillance drive-bys ³. EGodly publicly thanked DiamondCDN on Telegram on February 15, 2023 ³. KrebsOnSecurity documented Coristine's EGodly associations in its "The Com" reporting series ³.

In November 2022, law enforcement tracked Coristine under the alias "JoeyCrafter" for soliciting DDoS-for-hire services in the Dstat Discord channel ⁴. Coristine's three Connecticut LLCs — DiamondCDN LLC, MISTDECK LLC, and Tesla.Sexy LLC — were registered during this same period ⁴. Tesla.Sexy LLC (entity #896), registered in 2021 when Coristine was approximately 16, controls dozens of web domains including at least two Russian-registered domains; one active Russian domain operates an AI-powered Discord bot called "Helfie" targeting the Russian market ⁸. A Discord server associated with Tesla.Sexy LLC contains audio from November 6, 2021 of members conducting doxing and harassment operations, with references to membership in hacker communities Anonymous and Verm Squad ⁸. Of the three Connecticut companies, Tesla.Sexy LLC is the only one still listed as active ⁸.

Coristine's entry into government came through the Musk network. Before DOGE, he held an internship at Neuralink, the Musk-controlled neurotechnology company Connection #3008. At OPM, he reported up through Amanda Scales — a former xAI employee installed as OPM Chief of Staff — and was professionally connected to Elon Musk through DOGE's operational chain ⁴. The Revolving Door Project and LittleSis both document Coristine's placement as a DOGE Expert Connection #3252. He transitioned to SSA in June 2025 under Aram Moghaddassi, described in an SSA CDO whistleblower complaint as a longtime Musk ally Connection #3257.

According to a review of records from multiple news outlets, after Musk's departure from DOGE in late May 2025, Coristine resigned from the organization in late June 2025 ⁹. He then moved to the National Design Studio, a White House design unit led by Joe Gebbia — the Airbnb co-founder who simultaneously held a Tesla board seat and audit committee position while working in DOGE Connection #3258. Reuters confirmed Coristine's presence at the National Design Studio; he was credited with building the websites and brand identity for the Trump administration's "Genesis" AI initiative as part of a three-person team ⁵.

On August 3, 2025, Coristine was beaten in a carjacking attempt in Washington, D.C. ⁵. The incident subsequently became a stated justification for a Trump administration law-enforcement surge in the District ⁵. No financial disclosure was filed by Coristine through ProPublica's DOGE tracker at any point during his government service ¹.

Coristine's maternal grandfather, Valery Martynov, was assigned to Line X — the KGB's technical espionage division responsible for acquiring Western scientific and technological secrets — and stationed in Washington, D.C. ⁶. Beginning in 1982, Martynov operated as a double agent for the CIA and FBI under the codename "Gentile" ⁶. His identity as a Western asset was compromised by CIA officer Aldrich Ames, who sold Soviet intelligence to the KGB; Martynov was recalled to Moscow on a pretext, arrested, and executed on May 28, 1987 ⁶.

Martynov's daughter Anna — Coristine's mother — subsequently became a financial professional and married Charles Coristine, owner of the LesserEvil snack company ⁶. Edward Coristine was raised in New Canaan, Connecticut, attended Rye Country Day School (graduating 2024), and briefly enrolled at Northeastern University before leaving in spring 2025 ¹. This family background is relevant in the security clearance context: Coristine received unrestricted federal system access across multiple agencies without the standard background investigation process that would have evaluated both his family history and his documented 2022 cybercrime associations ⁶.

Coristine registered three limited liability companies in Connecticut: Tesla.Sexy LLC (entity #896), founded approximately 2021 when he was around 16 years old; DiamondCDN LLC (entity #920), registered August 23, 2022 at 26 Lakeview Ave, New Canaan, CT; and MISTDECK LLC ⁸⁴. Tesla.Sexy LLC is the only entity still listed as active and controls a portfolio of web domains, including Russian-registered domains hosting the "Helfie" AI Discord bot targeting the Russian market ⁸. MISTDECK LLC's operational purpose has not been established in the available record.

DiamondCDN LLC served as the corporate vehicle through which Coristine provided CDN infrastructure and DDoS protection to the EGodly cybercrime group from October 2022 through June 2023 ³. The timing of DiamondCDN's registration — two months after the Path Network firing — is consistent with the period in which Coristine was also posting in Discord about maintaining unauthorized access to Path Network systems ². The EGodly association documented in Reuters and KrebsOnSecurity reporting represents the clearest documented corporate link between Coristine's entity structure and cybercriminal infrastructure ³.