MetaMask Cuts a Core Developer Over North Korea Ties
The contributor spent nearly a month in MetaMask's core code and had previously worked on five projects that were all later breached.
MetaMask has removed a developer from its core code after tracing the contributor's connections to North Korea. The person had been committing to the wallet's underlying software for nearly a month before the link surfaced. It was flagged publicly in a tweet from the analytics account SolanaFloor, and MetaMask severed ties immediately.
The track record
This was not the developer's first job in crypto. The same contributor had previously worked on Ankr, Blueberry Protocol, DEPO, Pickle Finance, and Harmony. Every one of those projects was later hit by an exploit. Five for five.
Nobody has pinned a specific breach on the developer, and MetaMask has not claimed one person was behind the others. Correlation is not a confession. But a work history where five former employers all ended up drained reads very differently once the sixth finds a North Korea link buried in its commit history.
Why it lands hard
MetaMask sits at the front door of DeFi and NFTs for a huge share of retail users, and the code it ships is what stands between those users and their keys. Commit access to that codebase is about as sensitive as it gets in this industry. A month of contributions from a North Korea-linked account, merged or not, is the kind of exposure that keeps security teams up at night. Wallet code is a bad place to discover a vetting gap after the fact.
The uncomfortable part is structural. Open-source projects run on outside contributors, and almost none of them background-check a pseudonymous handle before accepting a pull request. Speed and openness are the whole point. They are also the attack surface. The qualities that make open-source software trustworthy in aggregate are the same ones that make any single contributor hard to vet.
The open question
For now, MetaMask has not published a review of what the contributor submitted, or said whether any of that code reached users. That is the detail that matters here. Until the wallet accounts for exactly what was merged during those weeks, the story is not the firing. It is the month before it.
Sources
- MetaMask Removes Developer Linked to North Korea
- SolanaFloor tweet on the MetaMask developer removal · SolanaFloor
Disclosure
Our stories are produced with a combination of human writers and AI tools, and every article is reviewed by a human editor before publication. Read more in our editorial policy. This article is for informational purposes only and is not financial, investment, or legal advice. Crypto assets are volatile and you can lose money — always do your own research.