North Korean hackers have appeared in CryptoQuant: what are they looking for in the Bitcoin market?
The analytical platform CryptoQuant recorded a unique case: a user visit from an IP address belonging to North Korea. This event sheds light on the tools and metrics that interest North Korean hackers, known for their activity in the cryptocurrency sphere.
A screenshot from the Amplitude system, published on social network X, reveals the details of the visit. The user, using Mac OS X, navigated to the Bitcoin: MVRV Ratio metric page via a Google search. Geolocation by IP itself is not 100% proof of identity, but in the context of North Korea, this case takes on special significance.
Why is this most likely a hacker, not an ordinary citizen?
Access to the global internet in North Korea is a privilege, not a right. It is available only to a select few: government officials, the military, and, of course, hacker groups working for the regime. An ordinary citizen does not have the ability to freely access the internet. Therefore, a visit from a North Korean IP almost certainly indicates a state agent, not a curious ordinary person.
The interest in the MVRV Ratio metric (Market Value to Realized Value) is telling. This indicator compares Bitcoin's market capitalization with its realized capitalization, helping to assess whether the asset is overvalued or undervalued relative to the average purchase price of coins. Why exactly a North Korean agent needed this analysis remains a mystery, but the context of North Korea's cryptocurrency activities suggests an answer.
Cryptohacking as an economic pillar for Pyongyang
North Korea is one of the main sponsors of cyberattacks on the crypto industry. The Lazarus Group and its offshoots, such as BlueNoroff, have already carried out some of the largest thefts in history: stealing over $600 million from the Ronin network (Axie Infinity) in 2022 and hacking the Coincheck exchange for $534 million in 2018. According to experts, these funds are used to finance the regime, bypassing international sanctions.
The fact that hackers are tracking Bitcoin's macroeconomic metrics indicates a high level of analytical preparation. They are not just technical executors, but strategists who study market cycles to choose optimal moments for liquidating stolen assets or planning new attacks.
My comment as an analyst: This episode is not just a curiosity, but an important signal for the entire market. North Korean hackers are moving from brute force to intelligence gathering. Their interest in indicators like the MVRV Ratio means they are seeking to minimize losses when converting stolen funds. For investors, this is an additional reminder that the movement of large wallets and on-chain metrics is now being monitored not only by traders but also by state-sponsored cybercriminals.