MetaMask Hired DPRK-Linked Hacker as Developer, DeFi Researcher Says

DeFi researcher Zun2025 said on X that MetaMask hired a developer linked to North Korea without conducting proper background checks. According to Odaily, the researcher said the hacker’s GitHub account, imyugioh, had been publicly listed on the Lazarus Group website since September 2025, but MetaMask still hired the person in March 2026. The post said the source was lazarus.group/team/mauro-liu and added that the developer was given access to a core code repository despite being on a public list of DPRK hackers. It also criticized smaller protocols that do not have dedicated security teams. Earlier reports said a North Korean hacker identified as Tyler Knapp had joined the MetaMask team through an outsourced human resources vendor. The person allegedly bypassed the company’s direct-hiring background checks, worked at the company for one month, and contributed to development of the wallet’s fiat on-ramp and off-ramp features. MetaMask later detected unusual IP and behavioral activity during the period, revoked all of the person’s permissions, and suspended all product releases the person had handled. No material data or fund losses were reported.