ConsenSys Accidentally Hires North Korean Agent—Access to Core Code of MetaMask Revealed for One Month

ConsenSys Accidentally Hires North Korean Agent

It has been revealed that the major blockchain company ConsenSys inadvertently hired a software developer connected to the North Korean government as a consultant.

This developer used the alias "Tyler Knapp" and the GitHub account "imyugioh," and was involved in the core code development of the company’s main service, the cryptocurrency wallet MetaMask, for about one month.

Intrusion Through Clever Identity Fraud

According to ConsenSys's legal advisor, Matt Corva, this individual was contracted not through direct employment but via a referral from a reputable external third-party service provider.

The developer participated in the project starting March 9, 2026, and was involved in developing features that connect cryptocurrency users with external fiat payment providers. Subsequently, the company detected the threat in April and immediately revoked the individual’s access rights. During the investigation period, all product releases were temporarily halted, and employees were placed under strict orders to avoid contact with the individual and maintain confidentiality.

Damage Assessment and Company Response

As a result of ConsenSys's comprehensive internal investigation and information sharing with law enforcement, the following facts have been confirmed:

**- No misappropriation of assets or data

• No deployment or alteration of malicious code
• No impact on user safety or security**

The company stated, "This incident has demonstrated the effectiveness of our security procedures in detecting complex threats at the national level," while also indicating plans to revise outsourcing practices to apply stringent screening criteria equivalent to direct employment for engineers via external vendors.

Threat of Internal Intrusion Facing the Cryptocurrency Industry

This incident highlights the reality that North Korean hacker groups are shifting their tactics from traditional cyberattacks to exploiting fake identification, remote work systems, and infiltrating through "legitimate hiring routes" via third-party organizations.

According to data from TRM Labs, approximately 66% (around 104.4 billion yen) of the cryptocurrency stolen through hacking in the first half of 2026 was attributed to North Korean-related groups.

The suspension of releases at ConsenSys, which is responsible for critical infrastructure for Ethereum, is evidence that the company takes this risk extremely seriously. Cryptocurrency companies will now be compelled to strengthen governance not only against smart contract bugs but also against "internal risks (supply chain risks)" including contractors and consultants.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.