ConsenSys Hired North Korean Hacker Who Accessed MetaMask Core Code

North Korean IT workers targeting Western tech firms, especially crypto companies, has become a persistent cybersecurity threat. The FBI and the Treasury Department have warned about DPRK-linked workers. Operatives create convincing fake identities and land remote contractor positions. They funnel earnings back to the regime.

MetaMask is one of the most widely used crypto wallets worldwide, serving as a gateway to decentralized applications. Access to its core codebase, particularly the conversion features, represents a sensitive attack surface. The operative’s access lasted roughly a month before the alert was triggered. In other cases, North Korean workers have maintained their positions for months or years.

ConsenSys has started a review of its third-party vendor practices. The company declined to comment on whether the operative had access to any customer funds or private keys. Law enforcement has not disclosed further details.