Digital Wallet

Story: North Korea-Linked Contractor Had MetaMask Code Access for Over a Month

By Bruce Buterin

1 / 15

Product Releases Frozen During Investigation. When the internal alert went off in April, Consensys did something pretty drastic: it froze all…

2 / 15

What the FBI and UK Cyber Authorities Are Warning. The FBI has been banging this drum for a while. North Korean IT workers, the agency has warned,…

3 / 15

The 76% Problem Across Crypto. CryptoSlate reported that operational compromises accounted for about 76% of stolen value in early…

4 / 15

A North Korea-linked contractor got inside MetaMask's codebase. Not for a day. For roughly a month — from March 9 until Consensys cut off access in April.

5 / 15

Consensys confirmed no assets were stolen, no user data walked out the door, and no malicious code made it into production.

6 / 15

When the internal alert went off in April, Consensys did something pretty drastic: it froze all MetaMask product releases. Everything stopped.

7 / 15

Corva noted the third-party provider Consensys used was reputable. That's not a dodge — it's actually the uncomfortable part.

8 / 15

The broader question here is access management. Who gets to see what, and for how long. In a remote-heavy industry like crypto development, that question doesn't have a clean…

9 / 15

The FBI has been banging this drum for a while. North Korean IT workers, the agency has warned, use network access to copy code repositories and exfiltrate data.

10 / 15

The UK National Cyber Security Center adds its own layer. Their advice: make all repository activity attributable, scrutinize every external contribution, and revoke access fast…

11 / 15

MetaMask's own security guidelines flag exactly this threat — malicious workers using fake identities to get inside organizations.

12 / 15

Read also: France Blocks Polymarket as ANJ Orders ISPs to Cut Access Over Illegal Gambling

13 / 15

That number matters for how the whole industry thinks about security. Protocol teams and wallet developers can build the most airtight smart contracts in the world, but if a…

14 / 15

The advice circulating now — from the FBI, from MetaMask's own guidelines, from security researchers broadly — is pretty consistent.

15 / 15

Consensys actually had that last piece in place. The April pause on product releases wasn't improvised — it was a mechanism that could be triggered.

The Currency Analytics

Want the full story?