Trail in the Network: How North Korean Hackers Exposed Themselves While Studying Bitcoin Analytics
The CryptoQuant platform recorded a unique incident: a user with an IP address from North Korea visited a page featuring the MVRV Ratio metric. The service reported this incident on social media, shedding light on which tools and data are of interest to North Korean hackers.
Visit Details: What Exactly Was Studied?
According to screenshots from the Amplitude analytics system, the visit was made from a Mac OS X operating system. The user navigated to the Bitcoin: MVRV Ratio metric page via a Google search. This fact in itself is not mere curiosity. Given the tightly controlled internet access in North Korea, where the network is available only to a select few—government officials, diplomats, and the military—such a visit highly likely points to a professional agent rather than an ordinary citizen.
Why This Matters: Context and Threat
Interest in on-chain analytics from North Korean entities is no coincidence. North Korea regularly appears in blockchain analysts' reports in connection with hacker groups such as the Lazarus Group. They are attributed with the largest thefts in cryptocurrency history: stealing over $600 million from the Ronin network (Axie Infinity) in 2022 and hacking the Coincheck exchange for $534 million in 2018. For a country under strict sanctions, digital assets have become a critically important economic resource, allowing it to bypass financial restrictions.
The single visit itself does not allow for identifying the user or directly confirming a link to state structures. Determining the country by IP address only indicates the network exit point, not a specific individual. However, the context—the choice of the MVRV Ratio metric, used to assess whether Bitcoin is overvalued or undervalued relative to the average coin acquisition price—indicates a high level of competence.
Cryptalist Analytics: What This Means for the Market
This incident is a stark reminder that North Korean hackers not only steal assets but also actively study market metrics. Interest in the MVRV Ratio may indicate that they are assessing the current cycle phase to plan the liquidation of accumulated funds. The market should consider this factor as one of the potential risks when analyzing support and resistance levels. For now, this is just a single case, but it confirms that North Korea continues to modernize its approaches to cryptocurrency operations.