Taylor Monahan

Overview

Taylor Monahan is a security lead at MetaMask who specializes in tracking cryptocurrency hacks, including campaigns tied to North Korea’s Lazarus Group (CoinDesk). She co-founded the MyEtherWallet wallet interface in 2015, later launched MyCrypto as a fork of it, and joined ConsenSys when it acquired MyCrypto (CoinCodex). In 2025 she was among the blockchain security researchers who publicly challenged Accountable.US’s “American Sell-Out” report and disputed its claim that World Liberty Financial had sold tokens to a Lazarus-linked buyer (Standing Record).

One caution on the name: MetaMask’s own publications, DL News, CoinDesk, and CoinCodex all spell her surname “Monahan,” while the “Monahan” spelling appears in the Standing Record entry and derivative coverage of the World Liberty Financial dispute. This profile retains the assigned spelling and flags the discrepancy rather than silently picking one (Standing Record, CoinDesk).

The World Liberty Financial dispute

On September 18, 2025, the watchdog group Accountable.US published a report titled “American Sell-Out” alleging that World Liberty Financial (WLFI) had sold tokens to buyers whose wallets showed prior links to sanctioned or high-risk networks (Standing Record). The report’s most explosive claim was that a wallet linked to North Korea’s Lazarus Group hacking operation had bought WLFI tokens; the buyer was identified by the handle “shryder.eth” (Standing Record, The Coin Republic).

Monahan and fellow blockchain investigator Nick Bax of Ump.eth challenged that analysis and disputed the Lazarus finding (Standing Record). According to an analysis of the episode, the supposed Lazarus link came from a joke memecoin contract — identified as “Dream Cash” — that had a labeled Lazarus wallet set as its contract owner, so merely claiming the token made the transfer look as though it came from the hacking group. The analysts had treated the token claim as proof of a real connection without checking the contract or the group’s actual transaction list (The Coin Republic).

The false positive had a real cost: World Liberty Financial froze roughly $95,000 of the affected user’s tokens (Standing Record). The same analysis said the wallet had previously been blocked by automated compliance tools at Uniswap and OpenSea, an illustration of how a single bad tag can follow a user for years (The Coin Republic). On November 17, 2025, Senators Elizabeth Warren and Jack Reed cited the Accountable.US findings in a letter asking the Treasury and Justice Departments to answer questions about WLFI’s compliance controls, and WLFI said it had frozen a subset of wallets in September 2025 after what it described as third-party security lapses such as phishing attacks and exposed seed phrases (Standing Record).

From MyEtherWallet to MetaMask security lead

Monahan entered crypto as a builder rather than an investigator. She co-founded MyEtherWallet — an open-source, client-side interface for creating Ethereum wallets — with Kosala Hemachandra in 2015 (CoinCodex). After disagreements between the co-founders over long-term vision, she launched MyCrypto as a fork of the MyEtherWallet code, and the two projects developed along separate paths (CoinCodex). ConsenSys later acquired MyCrypto, with its 12 employees joining the company behind MetaMask; at the time she said combining the teams would accelerate building “foundational and secure self-custody tools that empower the user” (CoinCodex).

As MetaMask’s security researcher she became known for incident response conducted largely in public. In January 2024, DL News described her as the wallet’s principal security researcher and followed her across three invitation-only Telegram “war rooms” during a week that saw an $81 million exploit of the Orbit Chain bridge, a $4.5 million theft from Radiant Capital, and a $6 million loss at Gamma Strategies (DL News). She told DL News there was “absolutely no accountability” when protocols were hacked, and that “DeFi exploits are always a race,” with “maybe 30 minutes tops” to determine a root cause and check whether other protocols were vulnerable (DL News).

Tracking the Lazarus Group

Long before the World Liberty Financial dispute, Monahan had built a public record of investigating North Korea-linked crypto theft. In April 2024, MetaMask reported that she had helped the on-chain investigator ZachXBT trace about $200 million that the Lazarus Group laundered into fiat between 2020 and 2023, following the trail through mixers and centralized exchanges across more than 25 hacks (MetaMask).

She also exposed a phishing operation by flagging a scammer who ran counterfeit versions of the self-destructing message service Privnote and threatened to sue MetaMask over a phishing-blocklist listing — a bluff that inadvertently revealed a network of lookalike domains. Journalist Brian Krebs detailed how those sites swapped real crypto addresses for the fraudsters’ own, with four scam addresses moving nearly $18,000 in crypto over a single five-day stretch in March 2024 (MetaMask). Earlier, she and MetaMask colleague Harry Denley had investigated a roughly $10 million multichain hack that drained around 300 longtime crypto users whose Secret Recovery Phrases were exposed; she explained the case to The Defiant, noting the attackers’ unusual method of swapping stolen assets within victims’ wallets before sending them to a decentralized exchange (MetaMask). In 2026 she appeared on the Blockspace podcast to explain a “highly sophisticated” $300 million-plus phishing attack tied to Lazarus, in which attackers hijack Telegram accounts and lure victims into fake Zoom meetings that install Trojan malware (CoinDesk).

The “American Sell-Out” claims, claim by claim

The Accountable.US report made several distinct allegations; only the Lazarus one was publicly disputed in the sources read.

Claim in the report	What was alleged	Status after scrutiny
Lazarus Group buyer	A Lazarus-linked wallet bought WLFI tokens via “shryder.eth”	Disputed by Monahan and Nick Bax; traced to a joke memecoin contract that listed a labeled Lazarus wallet as its owner (Standing Record, The Coin Republic)
Nobitex-linked buyer	Roughly 3,468 WLFI tokens bought in October 2024 by a wallet with a history on Iran’s largest exchange, Nobitex	Not disputed in the sources read (Standing Record)
A7A5-linked buyer	Over 10,000 WLFI tokens bought by a wallet that had transacted with A7A5, a ruble-backed token the U.S. Treasury sanctioned in August 2025	Not disputed in the sources read (Standing Record)
Tornado Cash users	At least 62 buyers had previously used the Tornado Cash mixer	Not disputed in the sources read (Standing Record)

Frequently asked questions

Who is Taylor Monahan? She is a security lead at MetaMask (ConsenSys) and a longtime on-chain investigator. She co-founded MyEtherWallet in 2015 with Kosala Hemachandra, later founded MyCrypto as a fork of it, and joined ConsenSys when it acquired MyCrypto (CoinCodex, CoinDesk).

What did she dispute about the Accountable.US report? She disputed the “American Sell-Out” report’s claim that World Liberty Financial sold tokens to a buyer linked to North Korea’s Lazarus Group. She and investigator Nick Bax argued the on-chain link was a false positive produced by a joke memecoin contract, and the mistaken identification led WLFI to freeze about $95,000 of an innocent user’s tokens (Standing Record).

Why was the Lazarus link a false positive? A joke memecoin contract called “Dream Cash” had a labeled Lazarus wallet set as its contract owner. When a user claimed the token, the transfer appeared to come from Lazarus — but the group never touched it. The report’s analysts treated the token claim as proof of a real connection without checking the contract (The Coin Republic).

Why is she considered an expert on Lazarus Group activity? She helped ZachXBT trace roughly $200 million that Lazarus laundered from more than 25 hacks between 2020 and 2023, and she has publicly analyzed Lazarus phishing campaigns, including a $300 million-plus Telegram-based attack discussed on the Blockspace podcast in 2026 (MetaMask, CoinDesk).

How is her name actually spelled? Independent sources — MetaMask’s own publications, DL News, CoinDesk, and CoinCodex — uniformly spell it “Monahan.” The “Monahan” spelling appears in the Standing Record entry and derivative coverage of the World Liberty Financial dispute; this profile retains the assigned spelling while flagging the discrepancy (CoinDesk, Standing Record).

What this profile does not claim

• It does not resolve the surname spelling definitively: independent sources say “Monahan” while the Standing Record entry and NewsBTC-derived coverage say “Monahan.” The two are treated as the same person (the MetaMask security lead), and the discrepancy is stated openly rather than silently resolved.
• It does not quote her own words in the World Liberty Financial dispute: her position is reported secondhand by Standing Record, since her original posts were not directly accessible.
• It does not adjudicate the report’s other claims (the Nobitex-, A7A5-, and Tornado Cash-linked buyers): they were not disputed in the sources read, but neither were they independently re-verified.
• The “Dream Cash” false-positive mechanism is reported per NewsBTC’s analysis of the episode, not from an independent on-chain audit conducted for this profile.
• It makes no claims about her personal life; only documented professional facts are included.