Consensys Freezes Releases After North Korean Impostor Infiltrates Team

Internal investigations revealed that the developer, who used the GitHub handle imyugioh, began submitting code on March 9 and remained active until April. Despite his involvement in core MetaMask infrastructure—specifically modules managing fiat payment integrations—Consensys general counsel Matt Corva stated that no malicious code was deployed and no user assets or data were compromised. The company initially sourced the contractor through a third-party agency, a process now under rigorous internal review.

This incident highlights a growing trend of employment fraud within the digital asset sector. Research from the Ketman Project identified approximately 100 suspected North Korean IT workers operating across 53 crypto projects, often utilizing forged identities and AI-generated profile imagery to bypass screening protocols. With North Korean actors reportedly responsible for a significant majority of stolen crypto value, security experts warn that embedding malicious developers into engineering teams has become a primary vector for infrastructure compromise.