Consensys Halts MetaMask Releases After North Korea-Linked Contractor Accesses Code

Consensys, the company behind the popular MetaMask wallet, recently halted all product releases for a month after discovering that one of its contractors had accessed sensitive code. The contractor, who was hired through a third-party provider, was linked to North Korea and worked on MetaMask's code from March 9 until Consensys cut off access in April.

Consensys' general counsel, Matt Corva, stated that the company identified the threat quickly, terminated access, launched a comprehensive investigation, and notified law enforcement. An internal alert ordered all product releases suspended pending the investigation, and staff were told not to interact with the consultant.

The incident has raised concerns about the security of contractor access and the potential risks of compromised developers within crypto projects. Consensys' existing relationship with the vendor left a gap that allowed the contractor to access sensitive code without proper safeguards in place.