North Korean hackers are monitoring the market: why Pyongyang needs the MVRV Ratio metric
The analytical platform CryptoQuant has recorded a unique case: a website visit from an IP address belonging to North Korea. A user who accessed the internet from this closed country purposefully searched for data on the Bitcoin MVRV Ratio metric. This observation is not just a statistical anomaly but an important signal shedding light on the operational methods of North Korean crypto hackers.
Visit Details: Who Was Looking for MVRV?
According to a screenshot from the Amplitude system, the visit was made from a Mac OS X operating system, the referral came from google.com, and the target page was the Bitcoin: MVRV Ratio chart. The author of the post from CryptoQuant rightly assumed that this visit was not from ordinary citizens but from representatives of the country's top leadership or state-sponsored hacker groups. This is explained by the strict structure of internet access in the DPRK: the global network is available only to a select few — government officials, military personnel, and diplomats. A single visit does not allow for identification but clearly indicates a professional interest in market metrics.
Cryptocurrency as an Economic Resource for Pyongyang
The DPRK's interest in the crypto market is no coincidence. North Korea regularly appears in blockchain analysts' reports as the epicenter of major cyberattacks. The most famous group, Lazarus Group, is attributed with hacking the Ronin network (Axie Infinity) for $600 million in 2022 and the Coincheck exchange for $534 million in 2018. For a country under strict sanctions, digital assets have become a critically important source of funding that is difficult to block using traditional methods. The DPRK authorities, of course, deny any involvement in these attacks.
Why Do Hackers Need the MVRV Ratio?
The MVRV Ratio (Market Value to Realized Value) metric compares the current market capitalization of Bitcoin with the average purchase price of all coins. It is used to assess whether the market is overheated or undervalued. For hackers operating with billion-dollar reserves of stolen funds, understanding this metric is critically important: it helps them choose the optimal time to convert loot into fiat, minimizing losses from price slippage. This is not mere curiosity — it is an element of professional risk management.
Cryptalist Analysis: The recording of direct interest in on-chain metrics from the DPRK confirms that North Korean hackers do not act chaotically but as highly organized financial structures. They not only steal assets but also actively analyze the market for their effective liquidation. The market should consider that large movements of Bitcoin from unknown wallets may be linked precisely to such operations. This adds another layer of complexity to forecasting short-term price movements.