Analysts at CryptoQuant have recorded a visit by North Korean hackers: what tools they are using
A notable event has occurred in the world of crypto analytics. The CryptoQuant platform recorded a visit from a user with an IP address belonging to North Korea (DPRK). This seemingly routine incident has caused widespread resonance in the professional community, as access to the global network in the DPRK is a privilege available only to a narrow circle of individuals associated with state, military, or diplomatic structures.
Details of the Visit: What Was Searched on CryptoQuant?
According to a screenshot from the Amplitude analytics system published on social network X, the North Korean user was interested in the MVRV Ratio (Market Value to Realized Value) metric for Bitcoin. The visit was made from the Mac OS X operating system, and the page was accessed via a Google search. The MVRV Ratio metric itself is a powerful tool for assessing whether an asset is overvalued or undervalued relative to its average purchase price. Why this particular metric attracted attention from Pyongyang remains an open question.
The author of the publication hypothesized that behind this visit are not ordinary hackers, but representatives of the country's top leadership, who are now personally studying on-chain analytics. If this assumption is correct, the interest in market metrics at the highest level indicates the strategic importance of cryptocurrencies for the regime.
Context: The DPRK and the Cryptocurrency Threat
The connection between North Korea and the crypto industry has long ceased to be a secret. Pyongyang regularly appears in reports from blockchain analysts in connection with the activities of hacker groups, such as the infamous Lazarus Group. They are credited with the largest thefts in history: the withdrawal of over $600 million from the Ronin network (Axie Infinity) in 2022 and the hack of the Coincheck exchange for approximately $534 million in 2018.
For a country under severe sanctions and isolated from the global financial system, cryptocurrency has become a critically important economic resource. Cyber operations allow obtaining funds that cannot be obtained through legal means.
My professional analysis: The single visit from a North Korean IP address in itself does not prove direct involvement in attacks, but it eloquently indicates that Pyongyang is actively monitoring the market and studying fundamental metrics. This suggests that their hacker operations are becoming not just "robbery," but an element of a well-thought-out state strategy for managing digital assets. The market should be prepared for new, even more sophisticated attacks based on a deep understanding of market dynamics.