Consensys confirms North Korea-linked developer worked inside MetaMask codebase
Security & Exploits ·
The Ethereum software firm says a contractor using a fabricated identity contributed to core wallet code for roughly one month before being cut off.
Consensys, the company behind the MetaMask crypto wallet, has acknowledged that it unknowingly brought on a software consultant tied to North Korea, according to internal messages reviewed by Drop Site News. The individual operated under the invented name "Tyler Knapp" and a matching GitHub handle, and was brought in through a referral from an outside service provider the firm already worked with.
Records cited by the outlet show the contractor's coding activity began on March 9 and stopped abruptly in April, putting his period of system access at about a month. During that window he reportedly touched core components of the MetaMask platform, including sections tied to converting between crypto and traditional currency through outside payment partners, and separately made changes to the wallet's mobile codebase before his credentials were cut.
This pattern fits a broader trend of operatives linked to North Korea posing as ordinary software engineers to win contracting jobs at US tech firms, a tactic security researchers say is aimed at stealing intellectual property or embedding access inside development pipelines. Consensys has not detailed how it ultimately linked the persona to North Korea.
Once suspicions surfaced, the company's general counsel told staff to halt all product releases and avoid any contact with the contractor while an internal probe ran its course, with a request that the matter stay confidential. The company says that investigation turned up no evidence of stolen funds or data, no malicious code inserted into its systems, and no risk to users, and that it has since referred the case to law enforcement. It has also opened a broader review of how it vets outside contractors and service-provider relationships going forward.
What remains unclear is exactly how the operative's national ties were confirmed, and whether any other Consensys-linked contractors introduced through the same third-party channel are under similar scrutiny. It is also not yet known whether law enforcement has opened its own case tied to the individual behind the "Tyler Knapp" persona.