ConsenSys inadvertently hired North Korean operative who accessed MetaMask’s core code

ConsenSys, the Ethereum-focused software company behind MetaMask, unknowingly brought on a North Korean national as a developer consultant, giving them access to core code powering one of crypto’s most widely used wallets. The individual operated under the alias “Tyler Knapp” and was introduced through what ConsenSys described as a reputable third-party service provider.

The consultant had access to MetaMask’s platform starting March 9, including features critical for crypto-to-fiat conversions.

How it unraveled

The engagement came to an abrupt halt in April 2026 after ConsenSys General Counsel Matt Corva issued an internal company-wide alert. What followed was a full investigation that confirmed the consultant’s ties to the Democratic People’s Republic of Korea.

ConsenSys reported no data compromise, no malicious code injections, and no impact on users during the consultation period. Law enforcement was notified following the discovery of the operative’s true identity. ConsenSys has since initiated a comprehensive review of its third-party vendor practices.

A pattern, not an anomaly

North Korean IT workers infiltrating Western tech companies, particularly crypto firms, has become one of the most persistent cybersecurity threats facing the industry. Operatives create convincing fake identities, land remote contractor positions, and funnel earnings back to fund the regime’s programs.

The FBI, Department of Justice, and Treasury Department have all issued warnings about DPRK-linked IT workers targeting American companies.

MetaMask is one of the most popular crypto wallets globally, serving as a gateway for millions of users interacting with decentralized applications. Access to its core codebase, particularly features handling conversions between crypto and traditional currency, represents an extraordinarily sensitive attack surface.

The operative’s access lasted roughly a month before the internal alert was triggered. In previous cases involving other companies, North Korean workers have maintained their positions for months or even years before being discovered.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.