Oops — a Suspicious Contractor Worked on MetaMask for a Month (No, Everything Didn’t Explode)

What happened?

Short version: a contractor hired through a third-party provider had access to MetaMask’s code for about a month, from March 9 until Consensys cut them off in April. Consensys says the person was later tied to North Korea, but their internal investigation found no stolen funds, no user data leaks, no malicious code pushed to production, and no compromise of user safety.

The company moved fast: the contractor’s access was terminated, law enforcement was notified, and an internal alert paused product releases while the incident was investigated. The outside provider was described as reputable, and Consensys says it has since tightened how it handles third-party relationships. Still, the episode revealed that having a relationship with a vendor doesn’t automatically mean every contractor account has the same protections as employees.

Lessons and how to avoid a digital facepalm

If you work on wallets, protocols, or any system that signs or moves money, treat every external worker like a potential plot point in a techno-thriller. That means identity checks aren’t a one-and-done box to tick at hiring — they should be verified during interviews, onboarding, and throughout the engagement. Use multiple verification steps: real documents, references, and multiple interviews help, and hardware-backed authentication keeps accounts safer from credential theft.

Keep repository access tight and visible. Best practices from security authorities recommend making every action in a code repo attributable to a person, reviewing every change that heads to production, and applying extra scrutiny to outside contributions. Least-privilege access, routine audits of staffing firms, and monitoring for unusual repository downloads or remote connections are also critical — these are the controls that catch the weird stuff before it becomes catastrophe-level weird.

Real-world data backs this up: security analysts found that operational compromises around keys, signing systems, custody, and approvals drove the lion’s share of stolen value in the first half of 2026, even when smart-contract bugs got more headlines. In plain English: access control and operational hygiene matter more than you might think.

Practical takeaways: keep third-party privileges narrow and temporary, require independent review for any production-bound change, revoke access the instant it’s no longer needed, and have a clear, pre-planned way to pause releases so you can investigate without chaos. Do those things and you’ll reduce the chances of a contractor mishap turning into a full-blown crisis — or at least make the follow-up press release less dramatic.