Crypto▼ Bearish
North Korean Operative Spent a Month Inside MetaMask Code
A suspected North Korean operative worked inside MetaMask's core wallet code for a month under a fake alias. The developer was flagged on a public database in September 2025 but kept committing code until April.
Continue with
A suspected North Korean operative worked inside MetaMask's core wallet code for roughly a month before getting caught. The developer, hired under the alias "Tyler Knapp," made real contributions to MetaMask's GitHub repository until April, when he was finally ousted after being flagged as a security threat.
Consensys, the parent company behind MetaMask, said Knapp was brought in through a reputable third-party service provider. Someone vouched for him. And yet security analyst Zun said the alias had already appeared on a public database tracking North Korean IT workers back in September 2025. Months passed. The developer kept committing code.
The database, run by the Security Alliance, exists to help crypto and tech companies avoid hiring operatives linked to the Democratic People's Republic of Korea. Knapp was listed there not just as "Tyler Knapp" but also under the name "Mauro Liu." Both names tied back to the same person, the same threat, Zun said.
The GitHub username "imyugioh" connected the developer directly to MetaMask's codebase. MetaMask was not his only stop. The Security Alliance's tracking site linked him to MagicCraft, a Web3 gaming company, back in 2022. Then Napier Finance, a DeFi product firm, in 2023. His name also appeared alongside Ankr, Pickle Finance, and Clover Network. That is a wide footprint for someone operating under a fake identity. It looks deliberate – a slow crawl through different corners of the crypto industry, picking up access and income along the way.
Zun was blunt. He criticized MetaMask and Consensys for not running a thorough background check, saying basic vetting could have stopped the hire before it started. The developer's involvement in converting cryptocurrencies and fiat currencies for third-party payment firms added another layer of concern, he said. That kind of financial access, in the wrong hands, can expose sensitive operations fast.
Consensys pushed back on the severity, at least in terms of damage. After terminating Knapp's access, the company ran an internal investigation. Their conclusion: no assets stolen, no malicious code deployed, no user data compromised. MetaMask's systems, they said, stayed clean. Whether you take that at face value depends on how much you trust internal investigations to catch everything.