Follow-up on the MetaMask team infiltrated by North Korean hackers: The hacker’s identity was publicly disclosed as early as September 2025, but still managed to bypass background checks by joining MetaMask as an outsourced worker in March this year.

Odaily reported, according to DeFi researcher @Zun2025 on X, “MetaMask hired a hacker associated with DPRK as a developer, without even conducting proper background checks. They could have discovered his identity.

The hacker’s GitHub account is imyugioh, and since September 2025 has been publicly listed on the Lazarus Group website, but MetaMask still hired this individual in March 2026. Source: lazarus.group/team/mauro-liu. Imagine, one of the largest wallets handed core code repository access to someone already on a publicly known DPRK hacker list. Now think about those small protocols with no security team at all—what could possibly happen.”

According to previous reports, a North Korean hacker named Tyler Knapp had infiltrated the MetaMask team. He joined MetaMask as an outsourced developer through a long-term HR supplier, bypassing the company’s direct hiring background checks. He worked at MetaMask for a month and participated in the development of wallet fiat on-ramp and off-ramp features. During this period, the company’s security monitoring detected abnormal IP addresses and suspicious behavior, after which MetaMask immediately revoked all his access and suspended all product launches he was involved with. No substantial data or fund losses have occurred so far.