flash on Nostr: ⚡️🦊🇰🇵 NEW - MetaMask was nearly infiltrated by a developer linked to ...
⚡️🦊🇰🇵 NEW - MetaMask was nearly infiltrated by a developer linked to North Korea.
Consensys, the company behind MetaMask, discovered that a consultant hired under the false identity of “Tyler Knapp” was actually linked to North Korea.
He worked on certain parts of the wallet’s code for nearly a month before being identified.
As soon as the threat was detected, the company revoked all his access privileges, temporarily suspended product releases, and launched a comprehensive code audit. According to Consensys, no backdoors were deployed, no assets or data were compromised, and users were not affected.
This incident illustrates an increasingly concerning trend in which actors linked to North Korea are now seeking to infiltrate crypto companies by getting hired as developers, rather than limiting themselves to external attacks.
Published at
2026-07-20 11:52:12 CESTEvent JSON
{
"id": "58c42a75307d09397ceb0d6f3104270052885a89ea66247379a8cd4d9f85b7f6",
"pubkey": "4d7842051782e0d3feb034d150adc2b6bae4ee3b49786793bffa468b6f5b96b3",
"created_at": 1784541132,
"kind": 1,
"tags": [
[
"client",
"Primal iOS"
]
],
"content": "⚡️🦊🇰🇵 NEW - MetaMask was nearly infiltrated by a developer linked to North Korea.\n\nConsensys, the company behind MetaMask, discovered that a consultant hired under the false identity of “Tyler Knapp” was actually linked to North Korea.\nHe worked on certain parts of the wallet’s code for nearly a month before being identified. \n\nAs soon as the threat was detected, the company revoked all his access privileges, temporarily suspended product releases, and launched a comprehensive code audit. According to Consensys, no backdoors were deployed, no assets or data were compromised, and users were not affected. \n\nThis incident illustrates an increasingly concerning trend in which actors linked to North Korea are now seeking to infiltrate crypto companies by getting hired as developers, rather than limiting themselves to external attacks. \nhttps://blossom.primal.net/9619c3571c3601716000d054b8fe57a2f12b39e1eb7342d31067ec38d954ae52.jpg",
"sig": "708114a3056f991a2529b9653097f6f2ff1b2c6000dc044143d2f156e9dd86322a1bef7945db920e3c5e35dc73bb3d9e77924e3d321ace5bd38bb20dd382b4ed"
}