Woofun AI reports that MetaMask engaged a developer linked to the North Korean Lazarus Group through an outsourcing arrangement, circumventing standard background verification procedures. DeFi researcher @Zun2025 highlighted that the individual, using the GitHub handle "imyugioh", had been publicly identified on the Lazarus Group website since September 2025, yet was hired in March 2026.

The developer, identified as Tyler Knapp, worked for one month on fiat on/off ramp functionality before security monitoring detected IP and behavioral anomalies. MetaMask immediately revoked all access permissions and suspended product releases associated with his work. No substantial data or financial losses have occurred to date.