MetaMask Parent Finds North Korean Spy in Its Engineering Team

Consensys recently discovered that a developer posing as a consultant for MetaMask was actually a North Korean operative. The individual used the alias Tyler Knapp and worked on core wallet features, including code related to fiat currency transfers. The company suspended his access in April after realizing his true identity.

While the situation sounds alarming, Consensys confirmed that no malicious code reached production and no user funds or data were stolen. The developer, who operated under the GitHub handle imyugioh, worked on the project for roughly one month. The company has since alerted law enforcement and is currently updating its hiring and vetting procedures for contractors.

This incident highlights a growing trend where state actors infiltrate crypto firms to gain access to sensitive infrastructure. Intelligence analysts warn that attacking development teams is now a primary strategy for hackers seeking to compromise wallet keys or withdrawal systems.

As North Korean IT workers continue to use fake credentials to secure remote roles across the industry, companies are under pressure to improve security. While Consensys avoided a major breach this time, the event serves as a warning for other projects to tighten their hiring standards and monitor contractor activity more closely.