Big Balls Now Exposed to Serious Criminal Charges in at Least Six States

Fired at 17 for leaking secrets. Served a cybercrime ring. Named by the Social Security whistleblower. Now the government’s model employee.12 min readSep 22, 2026--Press enter or click to view image in full sizePhotograph: Leigh Vogel/Getty ImagesNote from the author: below you’ll find an article, then a call to action, then the Existentialist Republic library. Thanks for reading.Subscribe nowOn Monday, September 14, Scott Kupor, the director of the Office of Personnel Management, went on Benny Johnson’s show to talk about hiring. Kupor sets personnel policy for the entire federal workforce.Asked what kind of people he wants, he said: “I wanna see people like ‘Big Balls,’ or Ed, as we call him colloquially. We need people like that.”He went on: “Ed is a great example. He dropped out of college. He never had substantive work experience before coming to DOGE.”So the head of federal hiring named, as his model employee, a 20 year old who was fired from his only real job at 17 for leaking company secrets, ran a web service for a cybercrime group, and is named in a whistleblower disclosure over a live copy of every Social Security record in the country.Edward Coristine was born in December 2005 and grew up in New Canaan, Connecticut. He graduated from high school in Rye, New York, in 2024 and was enrolled at Northeastern University as a mechanical engineering and physics major when he dropped out to join Elon Musk’s Department of Government Efficiency.His father is Charles Coristine, who bought the snack company LesserEvil in 2011 and runs it as chief executive. His maternal grandfather was Valery Martynov, a KGB lieutenant colonel who spied for the FBI and CIA in the 1980s and was executed in Moscow in 1987 after Aldrich Ames and Robert Hanssen betrayed him. Coristine has said on Fox News that his grandfather “died so that I could come here and live in this free country that I love so much.”Before government, Coristine built a trail of ventures and controversies that Bloomberg, Wired, Reuters, CNN, and Brian Krebs each documented.He owns Tesla.Sexy LLC, launched in 2021 when he was about 16, which has managed image-hosting domains, at least two of them registered in Russia.In 2022, as a 17 year old intern at the cybersecurity firm Path Network, he was fired. A Path executive wrote in an internal message reviewed by Bloomberg: “Edward has been terminated for leaking internal information to the competitors. This is unacceptable and there is zero tolerance for this.” He later boasted on Discord that he’d kept access to Path’s systems for months after termination.His content delivery network, DiamondCDN, provided services to a cybercrime group called EGodly, which claimed on Telegram to have stolen cryptocurrency, hijacked phone numbers, broken into law enforcement email accounts, and harassed an FBI agent. On February 15, 2023, EGodly posted its thanks: “We extend our gratitude to our valued partners DiamondCDN for generously providing us with their amazing DDoS protection and caching systems, which allow us to securely host and safeguard our website.” Reuters traced the EGodly site to internet addresses registered to DiamondCDN and other Coristine companies from October 2022 to June 2023.Krebs reported that Coristine was active in “The Com,” a network of Discord and Telegram channels where cybercriminals recruit and collaborate, under the handles “Rivage” and “JoeyCrafter.” Caleb Ecarma at Muskwatch reported, from web traffic records, that an image-sharing site Coristine ran was reachable through redirect addresses referencing child sexual abuse material and the Ku Klux Klan.Coristine has not answered any outlet’s request for comment on any of it.In 2025 he became one of the most recognizable people in DOGE. He worked out of the Office of Personnel Management and sat in on calls where federal technology workers were made to justify their jobs. Fox 5 DC reported he was one of two DOGE operatives given wide-ranging access to Small Business Administration systems in February 2025, which reached the National Finance Center, the system that processes payroll for agencies including the Department of Justice and the Department of Homeland Security.Reuters found him listed as a senior adviser at the State Department and at the Cybersecurity and Infrastructure Security Agency, where Nextgov confirmed he had a Homeland Security email address and physical access to the building. On May 31, 2025, the General Services Administration hired him full time at GS-15, the highest grade in the civil service.He was 19.He resigned from the General Services Administration in June 2025, and within days the Social Security Administration confirmed it had hired him as a special government employee to work on the functionality of the Social Security website.The Social Security Administration keeps a master file called NUMIDENT, the record of everyone who has ever held a Social Security number, living or dead, with the name, birth date, parents’ names, and citizenship of each holder.On August 26, 2025, the agency’s chief data officer, Charles Borges, filed a whistleblower disclosure with the Office of Special Counsel and Congress through the Government Accountability Project. Borges alleged that DOGE personnel had copied NUMIDENT into a cloud environment they controlled, outside the agency’s security monitoring, covering more than 300 million Americans.The disclosure names four DOGE personnel. Coristine is listed first, and a footnote describes his “lengthy history of facilitating, soliciting, or possibly participating in cybercrime.” Borges also names Coristine among the officials he asked for information and who did not respond.The copy itself went like this. John Solly, another of the four, called a career agency employee on June 10, 2025 to open discussions about copying NUMIDENT, four days after the Supreme Court restored DOGE’s access to Social Security data, and Michael Russo approved it. The agency’s own security review rated the project high risk with potential catastrophic impact. Aram Moghaddassi signed the provisional authorization to operate on July 15, 2025, writing: “I have determined the business need is higher than the security risk associated with this implementation and I accept all risks.”Coristine, according to the records in the disclosure, was involved in the project and was to be given access to the server.On January 16, 2026, the Department of Justice filed a Notice of Corrections in the Social Security case in federal court in Maryland. The filing admitted that sworn statements the government had given the court about DOGE’s access to Social Security systems were materially inaccurate, that DOGE staff had routed data through an unapproved third-party server, and that a DOGE member had signed a data agreement with a political group.NPR reported from the filing that on the morning of March 24, 2025, while Judge Ellen Hollander’s restraining order was in effect, a DOGE staffer was searching the master database at the same time agency officials were telling the court that all access had ended.