Consensys confirms North Korean developer accessed MetaMask code before detection

Blockchain firm Consensys confirmed a North Korean developer, using the alias 'Tyler Knapp,' infiltrated its team and accessed core code for its MetaMask wallet for a month. Hired via a third-party, the operative was detected and terminated in April. Consensys reports no malicious code was deployed or user funds impacted, but the incident highlights North Korea's ongoing targeting of the crypto industry, which lost billions to state-sponsored hacks in 2025.

North Korean infiltration incident

• ▪The developer was hired as a consultant through a third-party service provider, not directly through Consensys's internal hiring process
• ▪Consensys, the company behind the MetaMask crypto wallet, confirmed it accidentally hired a North Korea-linked software developer
• ▪The developer operated under the alias 'Tyler Knapp' and used the GitHub handle 'imyugioh'

Developer activity timeline

• ▪The operative worked on the core MetaMask code for approximately one month before being terminated
• ▪The developer had access to the core MetaMask codebase, including code that converts crypto to fiat currency and the mobile wallet codebase
• ▪The developer's code contributions on GitHub began on March 9 and ended in April when Consensys terminated his access

Consensys security response

• ▪In April, Consensys general counsel Matt Corva issued a company-wide alert suspending all product releases pending an investigation
• ▪A Consensys investigation concluded there was no misappropriation of assets or data, no malicious code deployed, and no impact to user safety
• ▪Consensys alerted law enforcement about the incident and is reviewing its vetting process for contractors

North Korean IT worker schemes

• ▪North Korean operatives frequently pose as remote software engineers to infiltrate American companies, particularly in the crypto sector
• ▪An Ethereum-funded project recently identified 100 suspected North Korean IT workers operating across 53 different crypto projects
• ▪These infiltration schemes sometimes use US-based facilitators running 'laptop farms' to mask the workers' true location

Crypto industry targeting

• ▪According to TRM Labs, North Korea-linked actors were responsible for more than half of the $2.7 billion lost to crypto hacks in 2025
• ▪The FBI attributed the $1.5 billion theft from the Bybit exchange in 2025 to North Korean hackers