Odaily Planet Daily News, according to DeFi researcher @Zun2025 on platform X, "MetaMask hired a hacker associated with the DPRK as a developer without even conducting a proper background check, which could have revealed his identity.

The hacker's GitHub account is imyugioh. Since September 2025, he has been publicly listed on the Lazarus Group website, yet MetaMask still hired this person in March 2026. Source: lazarus.group/team/mauro-liu. Imagine that one of the largest wallets granted core code repository access to someone already on a publicly known list of DPRK hackers. Now, think about what could happen to small protocols with absolutely no security team."

Previously reported, a North Korean hacker named Tyler Knapp infiltrated the MetaMask team. He entered MetaMask as an outsourced worker through a long-term cooperating human resources provider, bypassing the company’s direct-hire background check. He worked at the company for a month and participated in the development of the wallet’s fiat on-ramp and off-ramp functionality. During this time, abnormal IP and behavioral patterns were detected by the company's security monitoring. The company immediately revoked all of his permissions and halted the release of all products he had worked on. So far, no substantive data or financial loss has occurred.