North Korea-Linked Contractor Had MetaMask Code Access for Over a Month

A North Korea-linked contractor got inside MetaMask’s codebase. Not for a day. For roughly a month — from March 9 until Consensys cut off access in April. The contractor came in through a third-party provider, and the breach sat undetected long enough to make anyone in crypto security uncomfortable.

Consensys confirmed no assets were stolen, no user data walked out the door, and no malicious code made it into production. Matt Corva, Consensys’ general counsel, said the company quickly spotted the risk, killed the contractor’s access, launched a full investigation, and looped in law enforcement. Fast response, yes. But the fact that someone with North Korean ties was sitting inside MetaMask’s code for weeks is the part that sticks.

Product Releases Frozen During Investigation

When the internal alert went off in April, Consensys did something pretty drastic: it froze all MetaMask product releases. Everything stopped. Staff got instructions to avoid any contact with the contractor — no messages, no shared systems, nothing. It’s a blunt move, but probably the right one when you don’t yet know what someone has touched or what they were planning.

Corva noted the third-party provider Consensys used was reputable. That’s not a dodge — it’s actually the uncomfortable part. The contractor didn’t sneak in through some shady backdoor vendor. They came through a legitimate channel, which makes the whole thing harder to catch in advance. Since the incident, Consensys says it’s raised its third-party service standards to match what it applies internally. Whether that’s enough, unclear yet.

The broader question here is access management. Who gets to see what, and for how long. In a remote-heavy industry like crypto development, that question doesn’t have a clean answer.

What the FBI and UK Cyber Authorities Are Warning

The FBI has been banging this drum for a while. North Korean IT workers, the agency has warned, use network access to copy code repositories and exfiltrate data. The playbook involves false identities, forged documents, and enough technical credibility to pass initial screening. The FBI’s guidance stresses identity checks at onboarding, sure — but also continuous verification throughout employment. Not just a one-time background check. Ongoing.

The UK National Cyber Security Center adds its own layer. Their advice: make all repository activity attributable, scrutinize every external contribution, and revoke access fast when it’s no longer needed. That last one sounds obvious. It’s apparently not obvious enough.

MetaMask’s own security guidelines flag exactly this threat — malicious workers using fake identities to get inside organizations. The recommendations include multiple rounds of interviews, hardware authentication, IP verification, and reference checks that actually go somewhere. Basic stuff, maybe, but the Consensys incident shows that even reputable vendors can be compromised.

Read also: France Blocks Polymarket as ANJ Orders ISPs to Cut Access Over Illegal Gambling

The 76% Problem Across Crypto

CryptoSlate reported that operational compromises accounted for about 76% of stolen value in early 2026. That’s not hacks in the traditional sense — not someone brute-forcing a wallet. It’s insider access, contractor misuse, and access control failures. The kind of thing that’s hard to see coming because it looks like normal work until it doesn’t.

That number matters for how the whole industry thinks about security. Protocol teams and wallet developers can build the most airtight smart contracts in the world, but if a contractor has repository access and a motive, the code itself becomes the vulnerability.

The advice circulating now — from the FBI, from MetaMask’s own guidelines, from security researchers broadly — is pretty consistent. Conditional contractor access, not blanket access. Regular audits of third-party firms. Repository access that’s limited and logged. Independent review of every production-bound change. And a clear, pre-planned process to freeze operations when something looks wrong.

Consensys actually had that last piece in place. The April pause on product releases wasn’t improvised — it was a mechanism that could be triggered. That’s probably what kept this from getting worse.

And that’s worth sitting with for a second. The breach happened. A North Korea-linked actor was inside MetaMask’s code for a month. But the damage was contained. No assets misappropriated, no malicious code deployed, user safety intact. The response worked, even if the prevention didn’t fully hold.

The contractor came in through a reputable provider. They passed whatever screening existed. They had access from March 9. Consensys caught it in April, acted fast, told law enforcement, and rebuilt its third-party standards from there.

It’s a reminder that the threat isn’t always some sophisticated zero-day exploit. Sometimes it’s a contractor with a fake resume and enough patience to wait.

Corva confirmed law enforcement was informed. No further details on that front — the source didn’t specify which agencies beyond the initial notification, and Consensys hasn’t said more publicly.