North Korean hackers have appeared on CryptoQuant: analytical tools revealed
Analytical platform CryptoQuant has recorded a unique event: a visit from a user with an IP address belonging to North Korea (DPRK). This case sheds light on which analytical tools and metrics hackers from this closed country are interested in. Details of the incident were disclosed in a post on platform X.
Visit Details: What Was the Hacker Looking For?
According to a screenshot from the Amplitude analytics system, the visit parameters are as follows: page title — "Bitcoin: MVRV Ratio," referral from google.com, operating system — Mac OS X, and country — North Korea. The post author suggested that online analytics are now being handled by individuals close to the country's top leadership. If this guess is correct, interest in market metrics is being shown at the highest level.
The assumption about hackers did not arise by chance. In North Korea, access to the global internet is closed to the vast majority of citizens. The internet remains a privilege for a select few associated with state, embassy, or military structures. Therefore, a visit from a North Korean IP address most likely indicates a state agent rather than an ordinary user.
Judging by the screenshot, the user searched Google for data on the MVRV Ratio (Market Value to Realized Value) metric and landed on a relevant CryptoQuant page. The MVRV Ratio compares an asset's market capitalization to its realized capitalization and is used to assess whether Bitcoin is overvalued or undervalued relative to the average purchase price of coins. Why this metric was needed by a North Korean is unknown, but the very fact of interest in fundamental on-chain indicators suggests a high level of expertise.
Cryptocurrency and the DPRK: Context and Consequences
Interest in this post is heightened by the broader context. The DPRK regularly appears in blockchain analytics reports due to crypto hacker activity. According to a common theory among researchers, cyber operations provide the closed and sanctioned country with funds that are difficult to obtain through legal means. As a result, digital assets have become an important economic resource for Pyongyang.
Several hacker groups are linked to Pyongyang, the most famous of which is the Lazarus Group. They are attributed with the largest crypto thefts in history, including the withdrawal of over $600 million from the Ronin network (Axie Infinity) in 2022 and the hack of the Coincheck exchange for approximately $534 million in 2018. North Korean authorities themselves deny involvement in such attacks.
Expert opinion: This incident is not just a curiosity but an important signal for the market. The fact that North Korean hackers are actively studying on-chain metrics such as the MVRV Ratio indicates their desire for deeper market analysis. This means their attacks are becoming not only technically sophisticated but also strategically calculated, requiring market participants to be more vigilant and use advanced security systems.