Crypto▼ Bearish
North Korean Operative Infiltrated MetaMask for Four Weeks
A state-sponsored North Korean developer using a fake identity worked on MetaMask's fiat gateway for a month before detection. No funds or data were compromised.
Continue with
A state-sponsored North Korean operative infiltrated MetaMask's development team for roughly four weeks earlier this year, Consensys said. The individual, using the alias Tyler Knapp, never became a direct employee. They entered through a third-party human resources provider that supplies contract workers, bypassing standard verification checks.
Consensys said no user funds were lost and no malicious code was deployed. The company also said no sensitive data was compromised. It revoked all system access immediately after detecting the threat through automated monitoring of anomalous network connections and suspicious operational behavior.
The operative's GitHub profile, imyugioh, shows code submissions from March 9 until April 2026. Their work focused on MetaMask's fiat currency gateway infrastructure, the component that lets users move between traditional money and digital assets. That is one of the most security-critical parts of the wallet.
Consensys general counsel Matt Corva told personnel via internal communication that the company discovered the threat and launched a comprehensive investigation. "We confirmed there was no misappropriation of assets or data, no malicious code deployed, and no impact to user safety and security," Corva said.