MetaMask Hired North Korea-Linked Hacker in March 2026, Four Months After Identity Was Publicly Listed

According to DeFi researcher @Zun2025, MetaMask hired a developer linked to North Korea's Lazarus Group without conducting adequate background checks. The hacker's GitHub account, imyugioh, was publicly listed on lazarus.group/team since September 2025, yet MetaMask brought the individual on board in March 2026 through a contractor staffing agency, bypassing direct recruitment screening.

The hacker worked for approximately one month and participated in wallet fiat on-ramp and off-ramp functionality development. The individual was identified by the company's security monitoring due to anomalous IP addresses and suspicious behavior. MetaMask subsequently revoked all access permissions and suspended all product releases handled by this person. No material data or fund losses were reported.