North Korean hackers have appeared in analytics: what tools are they studying
The analytical platform CryptoQuant has recorded a unique incident: a user visit from an IP address belonging to North Korea. This is not an ordinary event, but a direct indication that professional hackers from the DPRK are actively studying on-chain analytics tools. Let's examine what exactly caught their attention.
Incident Details
According to data from the Amplitude system, the user visited a page featuring the MVRV Ratio (Market Value to Realized Value) metric for Bitcoin. The visit originated from google.com, and the device was running on Mac OS X. The visit itself from a North Korean IP is an anomaly, given that access to the global internet in the DPRK is strictly limited and granted only to select entities — state, military, and diplomatic structures.
The conclusion is obvious: behind this request is not an ordinary citizen, but a state agent, most likely associated with hacker groups. Interest in the MVRV Ratio — a metric that assesses whether Bitcoin is overvalued or undervalued relative to the average purchase price — indicates that North Korean specialists are not just stealing cryptocurrency but are also attempting to analyze market cycles.
Context: Cryptocurrency as a Resource for Pyongyang
This incident fits into the broader picture. The DPRK has long used crypto-hacking operations as one of its key sources of funding, bypassing international sanctions. The most well-known group is the Lazarus Group, which is attributed with some of the largest thefts in history: the withdrawal of over $600 million from the Ronin network (Axie Infinity) in 2022 and the hack of the Coincheck exchange for approximately $534 million in 2018.
The single visit itself does not reveal the user's identity, but it highlights a trend: North Korean hackers are professionalizing, moving from crude attacks to studying fundamental market metrics. This is a troubling signal for the entire industry.
My comment: The DPRK's interest in the MVRV Ratio is not mere curiosity. It is a sign that hackers want to understand when Bitcoin is at a bottom or peak to maximize profits from their operations. For the market, this means we are dealing with a highly organized adversary that operates not blindly, but using professional analytical tools.