Following North Korean hackers: CryptoQuant analytics reveals their tools
The analytical platform CryptoQuant recorded a visit from a user with an IP address belonging to North Korea. This event is not just a routine log entry, but a unique opportunity to glimpse into the operational environment of North Korean cybercriminals, who are known to be actively involved in the cryptocurrency sphere.
Visit Details: What is Known?
According to data from the Amplitude system, the visit parameters are as follows: the user searched Google for the metric Bitcoin: MVRV Ratio, navigated to the CryptoQuant page using the Mac OS X operating system, and their geolocation pointed to North Korea. The single visit itself does not reveal the individual's identity, but the context here is critically important.
Access to the global internet in North Korea is a privilege, not a right. The internet is provided only to a narrow circle of individuals associated with state, diplomatic, or military structures. Therefore, a visit from a North Korean IP address highly likely indicates a state agent, not an ordinary citizen.
Why is This Important for the Market?
The MVRV Ratio (Market Value to Realized Value) is a key on-chain indicator that compares an asset's market capitalization with its "realized" value, i.e., the average purchase price of the coins. It is used to assess whether the market is overheated or undervalued. Why would a North Korean hacker need this tool? The answer is obvious: for planning attacks and selecting optimal moments to liquidate stolen funds.
Context: North Korea and Cryptocurrencies
North Korea has long been associated with large-scale cryptographic attacks. The Lazarus Group, linked to Pyongyang, is behind the largest thefts in history: the theft of over $600 million from the Ronin network (Axie Infinity) in 2022 and the hack of the Coincheck exchange for approximately $534 million in 2018. For a country under sanctions, digital assets have become an important economic resource that is difficult to obtain through legal means.
My Expert Assessment
This incident is a stark reminder that North Korean hackers not only steal but also professionally analyze the market. The use of tools like the MVRV Ratio indicates a high level of preparation and a strategic approach. For market participants, this is a signal: monitor the activity of suspicious addresses, especially at times when metrics indicate local peaks or troughs. Pyongyang is playing a long game, and its actions can affect liquidity at critical moments.