Ethereum

Read

Security

Beacon

Humanity

<p class="is-style-lead">Consensys has temporarily halted product releases after a North Korea-linked consultant gained access to its systems for about one month.</p><div id="cn-block-summary-block_6099a069eb461644e70d591d71d410c9" class="cn-block-summary"><div class="cn-block-summary__nav tabs"><span class="tabs__item is-selected">Summary</span></div><div class="cn-block-summary__content"><ul class="wp-block-list"><li>Consensys halted product releases after a North Korea-linked consultant accessed its systems for one month.</li><li>An internal investigation found no stolen assets, exposed data, malicious code, or user harm.</li><li>Consensys will review contractor screening as North Korean operatives increasingly target crypto firms.</li></ul></div></div><p>Drop Site News <a href="https://www.dropsitenews.com/p/consensys-metamask-crypto-wallet-hired-north-korean-hacker?utm_source=substack&amp;utm_medium=email&amp;utm_content=share&amp;action=share" rel="noopener noreferrer nofollow">reported</a> that the developer joined the Ethereum software company under the alias “Tyler Knapp” and used the GitHub handle “imyugioh.” Public GitHub records reviewed by the outlet showed that the consultant began contributing code on March 9 before his access ended in April.</p><p>Internal messages obtained by Drop Site showed that Knapp worked on core MetaMask platform code, including sections used to connect crypto users with third-party fiat payment providers. Consensys suspended product releases during its investigation and instructed staff to avoid contact with the consultant, according to the report.</p><p>Consensys general counsel Matt Corva told Drop Site that an established third-party service provider introduced Knapp to the company. Corva stressed that Consensys treated him as a consultant rather than a direct employee.</p><p>You might also like: <a href="https://crypto.news/humanity-protocol-blames-north-korea-linked-hackers-for-36m-theft/" rel="noopener noreferrer nofollow"> Humanity Protocol blames North Korea-linked hackers for $36M theft </a></p><blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"><p>“Very quickly after being introduced, we discovered the threat, followed our security protocols, immediately terminated any access and launched a comprehensive investigation that confirmed there was no misappropriation of assets or data, no malicious code deployed, and no impact to user safety and security.”</p></blockquote><p>Although Consensys disclosed no financial losses, Corva said in a statement that the company would reassess how it outsources engineering and development work. The firm also notified law enforcement and provided information about the incident, according to internal communications reviewed by Drop Site.</p><h2 class="wp-block-heading" id="consensys-found-no-loss-of-user-assets">Consensys found no loss of user assets</h2><p>Consensys’ investigation found no evidence that the consultant stole company data or digital assets, inserted harmful code, or compromised users, according to Corva. The company did not publicly explain how it established the developer’s alleged ties to the Democratic People’s Republic of Korea.</p><p>Even without a confirmed loss, developer access can expose sensitive infrastructure. According to <a href="https://crypto.news/north-korea-denies-trm-labs-data-tying-it-to-major-crypto-hacks/" rel="noopener noreferrer nofollow">TRM Labs</a>, developer environments have become one of the quickest paths for attackers seeking access to systems that hold private keys or approve crypto withdrawals.</p><p>A six-month investigation supported by the Ethereum Foundation’s ETH Rangers Program <a href="https://blog.ethereum.org/en/2026/04/16/eth-rangers-recap" rel="noopener noreferrer nofollow">shows</a> that the hiring threat extends beyond Consensys. The Ketman Project identified about 100 suspected North Korean IT workers using false identities across 53 crypto and Web3 projects, according to an ETH Rangers recap published in April.</p><p>Ketman investigators also traced at least three suspected groups across 11 code repositories, where projects had merged 62 pull requests before detecting the activity. The project reported that some applicants used generated profile pictures, forged identity documents and false Japanese identities to pass screening checks.</p><h2 class="wp-block-heading" id="north-korea-remains-crypto-s-largest-hacking-threat">North Korea remains crypto’s largest hacking threat</h2><p>North Korea-linked groups have repeatedly used fake identities and remote engineering jobs to gain entry to technology companies. As crypto.news <a href="https://crypto.news/north-korea-has-infiltrated-up-to-20-of-crypto-firms/" rel="noopener noreferrer nofollow">reported</a> in November, Opsek founder and Security Alliance member Pablo Sabbatella warned at Devconnect Buenos Aires that North Korean workers could be embedded in as many as one-fifth of crypto companies.</p><p>Sabbatella also estimated that North Korean applicants account for roughly 30% to 40% of job applications received by crypto firms, suggesting that employment fraud is not limited to isolated cases.</p><p>Crypto companies face added risk because employees and contractors can receive access to code, wallets and transaction systems. TRM Labs <a href="https://crypto.news/north-korea-denies-trm-labs-data-tying-it-to-major-crypto-hacks/" rel="noopener noreferrer nofollow">estimated</a> that North Korea was responsible for 64% of the value stolen in crypto hacks during 2025, when total losses exceeded $2.7 billion. TRM Labs</p><p>One attack accounted for much of the damage. The FBI <a href="https://crypto.news/bybit-hack-a-north-korea-issue-and-not-a-crypto-issue-pro/" rel="noopener noreferrer nofollow">attributed</a> the February 2025 theft of about $1.5 billion from Bybit to North Korea’s TraderTraitor group, which dispersed the assets across thousands of blockchain addresses. FBI</p><p>TRM Labs reported that more than 30 exchanges and decentralized finance protocols now share rapid alerts through its Beacon Network when North Korea-linked funds reach participating platforms. For Consensys, the consultant’s removal prevented any known user loss, but the incident has prompted a review of the company’s third-party hiring controls.</p><p>Read more: <a href="https://crypto.news/north-koreas-crypto-hack-spree-draws-fresh-g7-warning/" rel="noopener noreferrer nofollow"> North Korea’s crypto hack spree draws fresh G7 warning </a></p>

Consensys halts releases after North Korea-linked developer gains access

Table of Contents

crypto.news

Other articles published on Jul 18, 2026

AKEDO Price Prediction: Why AKE Just Surged 40% Overnight

Praxis: The Decentralized Mesh Powering the AI Agent Economy

Ethereum Price Prediction: Can ETH Break Free From BTC's Grip?

Bitcoin Bounces Back as Chinese AI Innovation Reshapes Market Dynamics

Iran Suspends Implementation of Memorandum of Understanding with United States, Deputy Minister Says

Bitcoin Derivatives Momentum Fades Sharply, But Market Remains in Neutral Territory, Analyst Says

Join our free newsletter for daily crypto updates!