Consensus hires North Korean employees, salary loopholes exposed

Acknowledsys confirmed that North Korea-related contractors had brief access to the MetaMask core code.

Acknowledsys confirmed that a North Korea-related contractor had access to the MetaMask core code for about a month, before the company discovered and terminated its access in April. The contractor used the pseudonym "Tyler Knapp" and the GitHub account "imyugioh", introduced it through an external outsourcing provider, and came into contact with the core code of the mobile wallet, including the part connecting MetaMask users with third-party fiat exchange providers. Agresys said the review found no stolen funds, backdoor implants or user damage, a conclusion that has become the focus of most reports so far. However, during that month, Consensus was actually just one payroll cycle short of paying what the U.S. Treasury Department said was routinely used to fund North Korea's weapons program-a background that completely changed the nature of the incident.

Timeline

March 9, 2026:"Knapp" began submitting codes to the MetaMask mobile platform.
April 2026: Acknowledsys marks his identity, revokes access rights, suspends publication, and notifies law enforcement.
Ongoing: Consensus expands the screening criteria for direct employees to contractors recommended by suppliers.

Supplier Recommendations Why Bypass Consensus Systems 'Own Standards

General Counsel Matt Corva said Knapp was introduced through an existing relationship with a reputable third-party vendor and is considered a consultant rather than a direct employee. Direct employees need to pass the company's own screening, while contractors recommended by suppliers usually rely only on supplier screening, and few companies verify whether the latter meets their own standards. North Korean agents have taken advantage of this loophole to avoid human resources review by forging identity documents, reusing photos of unrelated professionals, and reusing resumes across dozens of applications. The U.S. Treasury Department's March 2026 sanctions list named an entity that manages the placement of overseas IT workers, as well as an intermediary accused of converting approximately $2.5 million in workers 'wages into cryptocurrency-wages that were transferred through intermediaries rather than implanted with malware through a code base.

Two ways North Korea can profit from cryptocurrencies

Most reports on North Korea and cryptocurrencies focus on exchange hacking. The Consensus sys event involves another channel that is less discussed.

Channel 1: Hacking and exploit-as of April 2026, accounting for 76% of 2026 losses; since 2017, TRM Labs has attributed more than US$6 billion.
Channel 2: Fraudulent remote hiring-In 2024 alone, the U.S. Treasury Department is estimated to generate nearly $800 million.

Ketman survey results: The scale is far larger than that of a single company

The Consensus sys case is part of a larger data set. The six-month investigation supported by the Ethereum Foundation's ETH Rangers project, released in April 2026 in the form of the Ketman project, identified approximately 100 suspected North Korean IT workers operating under false identities in 53 encryption and Web3 projects. Investigators tracked down at least three suspected action clusters involving 11 codebases, of which 62 merge requests had been merged before being flagged. Applicants behind some accounts use AI-generated avatars, forged identity documents and fictitious Japanese identities to pass routine screening. Pablo Sabbatella, a security researcher, Opsek founder and member of the Security Alliance, estimates that North Korean applicants account for 30% to 40% of job applications received by certain crypto companies, and warned at the Devconnect Buenos Aires conference that agents may have penetrated as many as one-fifth of crypto companies across the industry.

Both parties 'positions

Structural flaw: Allowing an unverified identity to write a fiat conversion code within a month suggests that the common vendor-recommendation recruitment model in Web3 assumes a level of trust that has never been really verified. Code review can spot errors, but it cannot spot an agent who patiently builds a clean submission history and waits for the opportunity to launch an attack.
The system is operating effectively: Consensus found anomalies within weeks, froze release, and found no missing or implanted content. By standards of user protection, this looks like the process is working as designed; while the risk of sanctions, while real, is a procurement issue rather than evidence that MetaMask itself is close to being breached.

Future changes

Corva plans to extend the screening criteria for direct employees to all vendor-recommended contractors, which may become industry default rather than a unique measure of Consensus. The Ministry of Finance has embarked on a crackdown on intermediaries that convert wages into cryptocurrencies, sanctioning new targets in 2025 and 2026, and given the current pace, subsequent sanctions may continue. Groups associated with the Ethereum Foundation have said they will continue to issue Ketman-style audit reports naming specific codebases, putting pressure on projects to review their list of contributors to avoid becoming the next to be named.

U.S. Department of the Treasury (OFAC): Fraud IT workers plan to generate nearly US$800 million in revenue to weapons program in 2024; Secretary Bessent said the North Korean regime "targets U.S. companies through fraudulent plans implemented by its overseas IT operatives."
TRM Labs: As of April 2026, North Korea accounted for 76% of cryptocurrency hacker losses, and the attributed amount exceeded US$6 billion since 2017.
Pablo Sabbatella (Opsek/Security Alliance): North Korean agents may have penetrated as many as one-fifth of crypto companies.

The same month that Consensus disclosed the matter, Republicans were briefing the White House on the CLARITY Act. The current provisions of the bill do not cover the screening of contractors or outsourcing suppliers, and this case is likely to serve as a basis for promoting the addition of relevant provisions.