A North Korean hacker infiltrated MetaMask to participate in its code development, with no data or financial losses incurred.

MetaMask developer Consensys has uncovered that a North Korean hacker infiltrated the MetaMask team under a false identity for roughly a month, contributing to core wallet code development. Operating under the name "Tyler Knapp", the individual joined as a consultant via a contractor, with a GitHub account under the handle imyugioh. Their code commits spanned from March 9 through April, and the hacker worked on sections of code related to cryptocurrency-fiat currency transfers. Upon identifying the risk, Consensys immediately cut off the hacker’s access, instructed employees to pause product releases and avoid contact with the individual, and reported the incident to law enforcement. General Counsel Matt Corva stated that investigations confirmed no assets or data were misappropriated, no malicious code was deployed, and user funds and security remained uncompromised. The company is now re-evaluating its contractor background verification procedures. TRM Labs noted that developer work environments have emerged as a critical entry point for attackers to target crypto firms’ keys and withdrawal approval systems. This follows a prior finding by an Ethereum grant project that identified 100 suspected North Korean IT professionals across 53 crypto projects.