North Korean hackers have made contact: CryptoQuant recorded a visit from an IP address in North Korea.
Analytics platform CryptoQuant recorded an extremely unusual visit: a user with an IP address from North Korea accessed the MVRV Ratio metric page for Bitcoin. This event, published on social network X, immediately attracted the attention of the crypto community, and for good reason. Given North Korea's strict isolation, only a select few have access to the global network, making this visit almost certainly the work of professional hackers rather than an ordinary citizen.
Visit Details: What We Know
According to a screenshot from the Amplitude analytics system, the visit parameters are as follows: page "Bitcoin: MVRV Ratio," referral from google.com, operating system Mac OS X, country — North Korea. The post's author suggested that on-chain analytics is now being handled by individuals close to the country's top leadership. If these assumptions are correct, interest in market metrics is being shown at the highest level.
It is important to emphasize: a single visit does not allow for identifying the user or directly confirming a connection to state structures. Determining the country by IP address only indicates the network exit point, not a specific person. However, the context makes this observation extremely significant.
Cryptocurrency and North Korea: Context of the Threat
North Korea regularly appears in blockchain analytics reports due to crypto hacker activity. According to a common theory among researchers, cyber operations provide the closed and sanctioned country with funds that are difficult to obtain through legal means. Digital assets have become an important economic resource for Pyongyang.
Several groups are linked to North Korea, the most famous being the Lazarus Group. They are attributed with the largest crypto thefts in history, including the withdrawal of over $600 million from the Ronin network (Axie Infinity) in 2022 and the hack of the Coincheck exchange for approximately $534 million in 2018. The North Korean authorities themselves deny involvement in such attacks.
Expert opinion: This incident is not just a curiosity, but a signal of the growing professionalization of North Korean cyber operations. Interest in the MVRV Ratio metric, which assesses the degree of overvaluation or undervaluation of Bitcoin, suggests that hackers are moving from simple thefts to studying market macroeconomics. This could mean preparation for more sophisticated market manipulations or an attempt to better understand the timing for cashing out profits from their illegal operations.