Edward Coristine got his nickname by accident. In math class during his junior year at Rye Country Day School, students were passing notes and, “when it got to him, he drew a phallic object and wrote BIG BALLS on it,” according to a current upperclassman. “Then a math teacher took it out of his hands and read it out loud to the class. Then I guess he embraced it because he changed his LinkedIn name to that.” Angad Sethi, one of Coristine’s best friends from high school, says, “To him, it was sort of talking about having big balls, being a risk-taker. That’s who he is. It was a joke, but it does have a meaning.”

Big Balls is now part of a revolution sweeping Washington, D.C., led by Elon Musk’s so-called Department of Government Efficiency, which in a series of lightning strikes has shut down the U.S. Agency for International Development, gained access to sensitive information on tens of millions of Americans, and initiated a purge of the federal workforce. A 19-year-old with a broccoli perm and piercing stare in his yearbook photo, Coristine has popped up everywhere, demanding that staffers justify their jobs by explaining their biggest “wins” and inquiring how to replace employees with AI and chatbots. By the end of his first month, he was inside the Departments of State and Homeland Security, the Small Business Administration, FEMA, and the top cybersecurity agency. He is the youngest of a group of six male engineers who work for Musk, sustained by pizza and Red Bull. Beleaguered government employees have taken to calling their young overlords “Muskrats.”

“He had an opportunity to make an impact, and he took it,” Sethi says of his friend, who graduated from high school last year and usually goes by “Eddie.” “He’s following his dreams, and he’s got the balls to drop out of school for a little while and take advantage of an opportunity that was presented to him. I mean, would you not take it if you were 19?”

Coristine’s hometown of Larchmont, a wealthy, mostly liberal enclave about an hour north of New York City, is an unlikely breeding ground for a right-wing foot soldier. His father, Charles, is a Wall Street veteran who bought the organic-snack company LesserEvil in 2011 and turned it into a behemoth with annual sales exceeding $100 million. (LesserEvil emailed customers “in light of recent events” to say that it is in “no way” affiliated with politics.) “His dad definitely inspires him,” Sethi says. And so does Musk: Coristine taught himself how to code and skipped senior prom to intern at Musk’s Neuralink, which develops brain-implantable computer chips. “It’s a compulsory thing for him to achieve,” Sethi says.

For the most part, Coristine was a normal teenager, wrestling and playing tennis, but he was a MAGA leader of the politics club at a predominantly liberal school and had Musk-like ambitions that led him to wear his early rejections as a badge of honor. At the bottom of a yearbook spread featuring photos of Coristine smiling with friends is a screengrab of an email he got from the CEO of internet-service company Cloudflare: “I think you’re foolish to try and build anything in this space at all.”

Coristine was a ubiquitous presence on messaging platforms such as Discord, where interests in gaming and cryptocurrency mingle with casual bigotry, trolling culture, and low-sophistication attacks on websites and users. “All of these online communities, they’re very hierarchical, and it’s very trust-based; things are very relationship-based,” says Andrew Morris, founder of the cybersecurity firm GreyNoise Intelligence. “People will try to win other people over by pulling some kind of stunt, any kind of prank to show they’re the man.”

Coristine has been linked to the Com, a network of Telegram and Discord channels that functions as a loose community for cybercriminals. In 2022, when he was 16, he lost a contract job as a system engineer at Path Network, a firm that markets protection from distributed denial-of-service attacks, allegedly for leaking corporate information to a rival company. In a Discord chat a few months later, Coristine didn’t explicitly deny the leak but chalked up his firing to corporate jealousy. “I was doing nothing contractually wrong,” he wrote. “Paranoia ended up terminating me.”

Path’s founder, Marshall Webb, had talked about rehiring Coristine, citing his extensive connections in the private channels where DDoS attacks are planned. “He’s networked so fucking hard,” Webb said in a conversation with employees that later leaked online. “He’s in all these different Discords; everyone knows who the fuck he is. The guy has figured out half of the equation with business.” But a former coworker dismissed Coristine as a skid, or “script kiddie”: a pejorative for a young wannabe hacker who relies on tools others have developed.

Wired found that Coristine once posted on Discord that he was “looking for a capable, powerful, and reliable L7,” a fairly sophisticated DDoS type of attack, that he could pay for with bitcoin. Morris said that Coristine appeared to be savvier than the median Discord lurker but that the way he asked about the attack suggested limited know-how. “It’s like saying ‘I want a capable, powerful key to this door,’” he says. “He’s got enough rope to hang himself with at a technical level, but he’s not splitting the atom anytime soon.”

Before he left high school, Coristine established an internet-service-provider company called Packetware, which hosted a number of domains he controlled. The Substack Musk Watch found one of them, Tesla.Sexy, which advertised “fake links, lots of cool domains, and effects to put on your images for ultimate shitposting.” When he registered a block of addresses for Packetware, Coristine wrote BALLERS in the description field.

Shortly after Donald Trump won the election in November, the DOGE account on X called for “super-high-IQ small-government revolutionaries willing to work 80+ hours per week.” Musk added that “compensation is zero.” Young engineers who worked for Musk or his mentor, Peter Thiel, spread the word across chat rooms and Discord that DOGE was looking for people willing to work for six months in Washington. Applications poured in from software developers, real-estate agents, and crypto traders, which meant stiff competition for Coristine, now a freshman at Northeastern University in Boston studying mechanical engineering and physics. “I remember when he was applying for this, I almost thought there was no way that this would happen,” Sethi says.

Two months later, Coristine was packing up his dorm room. “He was telling me he was moving out and just didn’t elaborate,” a friend told Northeastern’s student newspaper, except to say he was going to work for his dad and “do his own thing.” In fact, he was headed to the nation’s capital.

Minutes after Trump was sworn in on January 20, DOGE arrived at the Office of Personnel Management, the government’s human-resources department. “We help hire for everyone. We literally help hire the astronauts,” says a senior official who has been with OPM for more than a decade. Leading the DOGE team was Coristine’s boss, Amanda Scales, from Musk’s artificial-intelligence company xAI. They headed up to the executive floor carrying laptops and sofa beds, just as Musk’s employees had during the takeover of Twitter in 2022. “They went to town,” says the senior official. “They started demanding access to databases, code, and all this stuff that politicals have no real business being in — jobs data, who’s got security clearances, comprehensive federal government data.” They also plugged in to a private email server and eventually locked out senior staffers from the systems. By the end of the week, Musk had joined them and was seen working late alongside his staff.

Outside of the Office of Personnel Management in Washington, D.C., on February 7. Photo: Bryan Dozier/Middle East Images/AFP/Getty Images

Coming in to work on the 21st, we were entering a completely different world,” says a former employee who was terminated via videoconference during a mass firing in February. Visibly panicked directors held urgent meetings with staff about the chaos. During one, according to a current employee, a director was abruptly called up to the fifth floor, which has added armed guards since DOGE took over. “And then, all of a sudden, it was silence and has been ever since,” the former employee says. Supervisors advised staffers not to write messages on their government devices or even to say anything near them, according to the current employee. “The implication was that we were being watched,” adds the current employee. “That’s when everyone started to share the knowledge that the reason we were being told to stay off government devices was that Musk had brought in a server and a bunch of teenagers to troll our conversations.”

Armed with virtually unlimited personnel data, DOGE was now in a position to impose its will across the entire federal workforce. It sent an email with the subject line “Fork in the Road” to all 2.1 million employees via the private server, urging them to take a buyout. “OPM is sort of the vehicle driving DOGE across the government,” says Rob Shriver, the agency’s acting director until January.

DOGE was so secretive it took weeks for the public to learn who was operating the machinery of the federal government. When Wired revealed Coristine was only 19 in early February, the story exploded. “Everyone was talking about it, including faculty,” says an upperclassman at Rye. “I’m just shocked they are giving him such an insane role, and the fact that someone from my area is contributing is surprising to me.” When CNN ran a segment on Coristine and his Big Balls moniker, Musk responded online with two crying-laughing emoji.

“He’s really developed as a person in the last couple of months,” Sethi says. “I think school — high school, college — isn’t for him. It’s just too limited. There’s some people that need education to learn, and there are some people that don’t need it.”