Consensys, a prominent blockchain software company known for developing the MetaMask crypto wallet, has denied reports of a security breach affecting user assets or data. This clarification comes after the company discovered that an external contractor with connections to North Korea temporarily accessed MetaMask’s core codebase earlier this year.
Security incident and contractor background
The incident centered on a consultant operating under the alias “Tyler Knapp,” identified on GitHub as “imyugioh.” According to Consensys, this individual was not a direct staff member, but was engaged through a third-party provider to work on MetaMask. The consultant’s involvement with the wallet’s codebase spanned from March 9 to early April 2026, primarily focusing on features related to fiat on-ramp and off-ramp functionalities.
Consensys took immediate steps to address the potential threat upon its discovery. The company froze all new product releases, ended the consultant’s access, and initiated a thorough internal security review. Law enforcement agencies were promptly notified of the incident as part of the firm’s response protocol.
Mini dictionary: Fiat on-ramp and off-ramp, services that facilitate the conversion between traditional currency and cryptocurrencies, allowing users to deposit or withdraw funds using bank transfers or other standard payment methods.
Official statement and investigation results
Consensys addressed the concerns in a post on X, seeking to counter online speculation about the scope of the breach. The company outlined that its detection protocols worked as intended, enabling it to contain the threat rapidly.
Earlier this year, we identified and contained a threat from an individual engaged as a consultant through a third-party provider. After the threat was quickly identified, we immediately terminated all access, launched a comprehensive investigation, and notified law enforcement.
According to Consensys, a comprehensive internal assessment was conducted. This review found no indication that malicious code was introduced or that user funds or information were at risk during the incident. The firm further emphasized that there was no effect on the wallet’s performance, security, or functionality.
Our investigation confirmed no malicious code was deployed, no customer assets or data were compromised, and there was no impact to user safety, funds, or security.
Consensys response and user reassurance
After identifying the threat, Consensys placed a hold on all product updates to prevent any chance of an undetected security lapse. The company’s security team reviewed all recent changes to the codebase and worked to ensure full system integrity. Users were also notified that law enforcement was handling the case in collaboration with Consensys’ internal team.
With MetaMask serving millions of users globally as a gateway to decentralized web applications, Consensys moved quickly to address any potential risk. The company underscored its ongoing commitment to user safety and its investment in routine audits and security measures.
The identity and deeper background of the contractor remain under law enforcement investigation. Consensys has not disclosed further personal information regarding the individual or the specific third-party provider involved. The company stated that its protocols for screening external contributors are being reviewed and updated.
Consensys reiterated that MetaMask users do not need to take any additional action as a result of the incident, as customer assets and information remain secure.
