However, DeFi security analyst Zun claims<\/a> that Knapp had already been flagged on a public Lazarus Group operative tracking site back in September 2025.\u00a0<\/p>\n The page<\/a>, run<\/a> by the Security Alliance, creates profiles for known remote Democratic People\u2019s Republic of Korea (DPRK) IT workers in the hopes that it will help companies to identify them before they\u2019re hired.\u00a0<\/p>\n Read more: Crypto has become Kim Jong-Un\u2019s lifeline \u2014 and Russia\u2019s secret weapon<\/a><\/p>\n On the Lazarus Group site, Knapp appears<\/a> under the name \u201cMauro Liu.\u201d He also appears to have worked for Web3 game firm MagicCraft in 2022, and DeFi product firm Napier Finance in 2023.\u00a0<\/p>\n His other listed firms include Ankr, Pickle Finance, Harmoney, Gamerse, Clover Network, DEPO, Sifu Vision, Oxytocin, Tomodachi, and Blueberry.\u00a0<\/p>\n He\u2019s linked to MetaMask through the GitHub username \u201cimyugioh.\u201d\u00a0<\/p>\n Zun claims MetaMask hired him as a developer without a \u201cproper background check that would have caught him.\u201d<\/p>\n Consensys says North Korea dev didn\u2019t steal any assets<\/p>\n DropSite reports<\/a>, based on internal Slack messages, that Knapp was also contributing to code involving the conversion of crypto and fiat currency by third-party payment firms.<\/p>\n Consensys\u2019s General Counsel, Matt Corva, told DropSite, that Knapp \u201cwas introduced to us through an existing relationship with a reputable third-party service provider.\u201d<\/p>\n They said, \u201cVery quickly after being introduced, we discovered the threat, followed our security protocols, immediately terminated any access and launched a comprehensive investigation that confirmed there was no misappropriation of assets or data, no malicious code deployed, and no impact to user safety and security.\u201d<\/p>\n Last April, a North Korean mole called \u201cMoo\u201d was named<\/a> by crypto sleuth ZachXBT and was fired from Solana-based DEX Stabble.\u00a0<\/p>\n The firm subsequently encouraged all of its users to withdraw all their funds.\u00a0<\/p>\n Moo, real name Keisuke Watanabe, was, by its own admission, employed by Stabble for a whole year.\u00a0<\/p>\n Got a tip? Send us an email securely via\u00a0Protos Leaks<\/a>. For more informed news and investigations, follow us on\u00a0X<\/a>,\u00a0Bluesky<\/a>, and\u00a0Google News<\/a>, or subscribe to our\u00a0YouTube<\/a>\u00a0channel.<\/p>\n \t\t\t![\"\"](\"https:\/\/www.europesays.com\/korea\/wp-content\/uploads\/2026\/07\/1784562369_200_Screenshot-2026-07-20-at-12.06.51-1024x490.png\")
<\/a>MetaMask\u2019s North Korean developer is listed on the Lazarus Group site.<\/p>\n