North Korean hackers have appeared on CryptoQuant: what tools they use
The analytical platform CryptoQuant recorded an unusual visit to its service from an IP address belonging to North Korea. This event, published on social network X, sparked a wave of discussions in the crypto community, as internet access in the DPRK is a privilege available only to a select few, primarily government agencies and the military.
Visit Details: What Was the North Korean Looking For?
According to data from the Amplitude analytics system, the visit was made from a computer running Mac OS X. The user navigated to the page with the Bitcoin: MVRV Ratio metric via a Google search. This metric itself is an important indicator of Bitcoin's market overvaluation or undervaluation, comparing market capitalization to realized capitalization. However, the key detail is the country — North Korea.
The post author suggested that behind this visit are representatives of the country's top leadership, rather than ordinary hackers. In the context of North Korea's strict internet isolation, where only individuals connected to state, diplomatic, or military structures have access, such a visit highly likely points to a state agent. However, it is worth emphasizing that a single visit does not allow for identifying the user and does not directly confirm a connection to hacker groups.
Cryptocurrency and the DPRK: Context of the Threat
Interest in this incident is heightened against the backdrop of regular reports from blockchain analysts about the activities of North Korean hackers. The DPRK, under sanctions, actively uses cyber operations to obtain funds that are difficult to acquire legally. Digital assets have become an important economic resource for Pyongyang.
The most well-known group associated with North Korea is the Lazarus Group. It is blamed for the largest crypto thefts in history, including the withdrawal of over $600 million from the Ronin network (Axie Infinity) in 2022 and the hack of the Coincheck exchange for approximately $534 million in 2018. The DPRK authorities, of course, deny their involvement in such attacks.
Expert Opinion: The visit itself to the CryptoQuant page from a North Korean IP is not proof of a direct hacker attack. However, it demonstrates that even at the highest level in the DPRK, there is interest in fundamental Bitcoin market metrics. This may indicate that Pyongyang is not just using cryptocurrencies as a tool to bypass sanctions but is also trying to more deeply understand market dynamics to optimize its operations. The market should be on alert: the higher the interest in analytics, the more sophisticated the next attacks could become.