The Coinformer banner
the coinformer
Contact
Live 5m
T
The Coinformer Newsroom
News18 July, 20263 min read

MetaMask warned about North Korean fake hires. Five weeks later, one was working on its code

MetaMask warned about North Korean fake hires. Five weeks later, a consultant linked to the country began working on its code.

MetaMask/The Coinformer

Discuss this article:

PERPLEXITYCHATGPTCLAUDEGEMINI
Does this story need context? Notes are selected by independent community ratings, not editors.
How it works
Update July 19, 6:13 pm UTC. Consensys' official X account said in a post that the bad actor "was never a Consensys employee," adding that "after the threat was quickly identified, we immediately terminated all access, launched a comprehensive investigation, and notified law enforcement."

MetaMask, a self-custody crypto wallet made by Consensys, was already telling its users how to spot North Korean operatives applying for crypto jobs before one reached its own codebase, The Coinformer found.

  • On Jan. 31, MetaMask published its monthly security report and highlighted work by the Security Alliance, a non-profit crypto security group also known as SEAL.
  • The report said SEAL was showing companies "what to look out for" when protecting themselves against North Korean operatives applying for jobs at crypto firms.

MetaMask also directed readers to SEAL's hiring framework, a detailed guide designed to help companies recognize such applicants.

But just 37 days later, on March 9, a GitHub account using the name "imyugioh" began making public contributions to MetaMask, according to Drop Site News, an investigative news outlet that first reported the incident on Friday, July 17.

  • The consultant used the alias "Tyler Knapp" and was introduced to Consensys through what the company called a reputable outside service provider.
  • They weren't hired through Consensys' normal employee recruitment process.

The consultant worked on MetaMask's core software and parts of the wallet that help users move between cryptocurrencies and regular money through outside payment companies, Drop Site News writes.

  • They also contributed to MetaMask Mobile, the wallet's smartphone app, before their access was removed in April.
The timing suggests that Consensys' problem may not have been a lack of awareness. Instead, the company may have failed to apply the same checks to a consultant supplied by an outside company.

Matt Corva, Consensys' general counsel, told Drop Site News in a commentary that the company has since reviewed how it uses third-party services to make sure outside consultants face the same standards as direct employees.

  • Consensys detected the consultant roughly a month after their public contributions began.
  • Corva then told employees that "All product releases are to be suspended immediately pending investigation" and instructed them not to contact the individual.
Update July 19, 6:13 pm UTC. Nick Bax, an incident responder for SEAL 911, a crypto security hotline, said the North Korea-linked developer that worked with Consensys had previously worked at Ankr, Blueberry Protocol, DEPO, Pickle Finance and Harmony.

Corva added that the company's investigation found "no misappropriation of assets or data, no malicious code deployed, and no impact to user safety and security."

  • Consensys also removed the consultant's access and contacted law enforcement.
  • Consensys hasn't publicly explained how it concluded that the person behind the account was linked to North Korea.
North Korea