Consensys halted MetaMask code releases in April after discovering that a contractor with ties to North Korea had accessed the repository from March 9. The contractor was engaged through a third‑party provider and worked on MetaMask code until access was cut off. Consensys said its investigation found no evidence of asset misappropriation, malicious code deployment, or impact on user safety. General Counsel Matt Corva said the company identified the threat quickly, terminated the contractor’s access, launched a comprehensive investigation, and notified law enforcement. An internal alert in April instructed staff to suspend product releases pending the investigation and told staff not to interact with the consultant. Consensys said it characterized the service‑provider relationship as reputable and noted that it has reviewed its third‑party service practices to ensure the same rigorous standards applied to employees also cover outside relationships. The incident highlighted gaps in contractor access controls, prompting Consensys to reinforce requirements such as verified identification, multi‑interview screening, hardware authentication, IP and location verification, reference checks, and limited access to critical systems. The FBI has warned that North Korean IT workers have used similar remote‑work setups to copy code repositories. Guidance from the UK National Cyber Security Centre recommends attributing repository activity, reviewing all production‑bound changes, applying extra scrutiny to external contributions, and revoking access quickly when it is no longer required. Consensys said it will retain a predefined way to halt changes while suspicious access is investigated, underscoring the need for continuous monitoring of contractor privileges.