A North Korean dev and suspected mole who worked on MetaMask’s core wallet code for a whole month was reportedly flagged by a Lazarus Group security page almost a year ago.
The developer was reportedly hired by MetaMask’s parent firm, Consensys, as a consultant while posing under the alias “Tyler Knapp.” He reportedly made GitHub contributions to MetaMask’s wallet until he was ousted by the company in April.
However, DeFi security analyst Zun claims that Knapp had already been flagged on a public Lazarus Group operative tracking site back in September 2025.
The page, run by the Security Alliance, creates profiles for known remote Democratic People’s Republic of Korea (DPRK) IT workers in the hopes that it will help companies to identify them before they’re hired.
Read more: Crypto has become Kim Jong-Un’s lifeline — and Russia’s secret weapon
On the Lazarus Group site, Knapp appears under the name “Mauro Liu.” He also appears to have worked for Web3 game firm MagicCraft in 2022, and DeFi product firm Napier Finance in 2023.
His other listed firms include Ankr, Pickle Finance, Harmoney, Gamerse, Clover Network, DEPO, Sifu Vision, Oxytocin, Tomodachi, and Blueberry.
He’s linked to MetaMask through the GitHub username “imyugioh.”
Zun claims MetaMask hired him as a developer without a “proper background check that would have caught him.”
Consensys says North Korea dev didn’t steal any assets
DropSite reports, based on internal Slack messages, that Knapp was also contributing to code involving the conversion of crypto and fiat currency by third-party payment firms.
Consensys’s General Counsel, Matt Corva, told DropSite, that Knapp “was introduced to us through an existing relationship with a reputable third-party service provider.”
They said, “Very quickly after being introduced, we discovered the threat, followed our security protocols, immediately terminated any access and launched a comprehensive investigation that confirmed there was no misappropriation of assets or data, no malicious code deployed, and no impact to user safety and security.”
Last April, a North Korean mole called “Moo” was named by crypto sleuth ZachXBT and was fired from Solana-based DEX Stabble.
The firm subsequently encouraged all of its users to withdraw all their funds.
Moo, real name Keisuke Watanabe, was, by its own admission, employed by Stabble for a whole year.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
The post MetaMask hired suspected North Korean dev flagged months earlier appeared first on Protos.
