Consensys pauses releases after consultant with alleged North Korea links accessed MetaMask code
Consensys temporarily halted product releases and opened an investigation after a consultant with alleged ties to North Korea gained access to the company’s systems for roughly a month, Drop Site News reports.
What happened
- The contractor joined under the alias “Tyler Knapp” and used the GitHub handle “imyugioh.” Public GitHub records show contributions beginning March 9 and lasting until access was cut off in April.
- Internal messages reviewed by Drop Site indicate the consultant worked on core MetaMask code, including portions that integrate third-party fiat payment providers.
- Consensys suspended releases, barred staff from contacting the consultant, and removed his access while investigating.
Consensys’ response
- General counsel Matt Corva told Drop Site the consultant was introduced via an established third‑party service provider and was treated as a consultant rather than an employee.
- According to Corva, Consensys “very quickly” discovered the threat, followed security protocols, terminated access and launched a comprehensive investigation that found no evidence of asset or data misappropriation, no malicious code deployed and no impact to user safety or security.
- The company notified law enforcement and said it will reassess how it outsources engineering and development work. Consensys has not publicly explained how it established the consultant’s alleged ties to the Democratic People’s Republic of Korea.
Why developer access matters
Security researchers and firms have repeatedly warned that developer environments are a fast route for attackers to reach sensitive infrastructure — including private keys and withdrawal approval systems. TRM Labs highlights developer accounts as attractive targets for threat actors seeking footholds.
Broader industry findings
- A six‑month effort supported by the Ethereum Foundation’s ETH Rangers program (the Ketman Project) flagged roughly 100 suspected North Korean IT workers using false identities across 53 crypto and Web3 projects. Investigators traced at least three suspected groups across 11 code repositories and found 62 merged pull requests before the activity was detected.
- The Ketman Project said some applicants used generated profile photos, forged identity documents and fabricated Japanese identities to pass screening.
- Security experts have warned this is not isolated. At Devconnect Buenos Aires, Pablo Sabbatella of Opsek and Security Alliance suggested North Korean workers may be embedded in a sizable share of crypto firms and that a large fraction of job applications to crypto companies could originate from applicants using falsified identities.
The financial toll from state‑linked actors
TRM Labs estimated that North Korea accounted for about 64% of the value stolen in crypto hacks during 2025, when total losses exceeded $2.7 billion. One major incident was the February 2025 theft of roughly $1.5 billion from Bybit, which the FBI attributed to North Korea‑linked group TraderTraitor. In response to such threats, over 30 exchanges and DeFi protocols now share rapid alerts through TRM’s Beacon Network when suspected North Korea‑linked funds move to participating platforms.
What this means for Consensys and the sector
Consensys says the consultant’s removal prevented any known user loss, but the episode underscores the risks of third‑party hiring and developer access in crypto. Expect heightened scrutiny of vetting practices and outsourcing policies across the industry as projects reassess how they grant and monitor codebase access.
Read more AI-generated news on: undefined/news
