Analysts at CryptoQuant recorded a visit from a North Korean hacker: tools and objectives revealed
The blockchain analytics platform CryptoQuant recorded a unique case: a visit from a user with an IP address linked to North Korea. This incident, which has become a topic of discussion in the professional community, sheds light on the specific analytical tools used by North Korean crypto hackers and, more importantly, the goals they pursue.
A screenshot from the Amplitude analytics system, published in a post on the X platform, shows the details of the visit: the user navigated to the "Bitcoin: MVRV Ratio" page from Google, using the Mac OS X operating system. The geolocation by IP itself—North Korea—is a key marker. Given the strict internet isolation in North Korea, only a select few have access to the global network: employees of state, military, and diplomatic structures. Therefore, a single visit from North Korean territory highly likely indicates a state agent, not an ordinary citizen.
Why do North Koreans need the MVRV Ratio?
The MVRV Ratio (Market Value to Realized Value) compares an asset's market capitalization to its realized capitalization. It helps assess whether Bitcoin is overvalued or undervalued relative to the average purchase price of coins. The North Korean user's interest in this metric is no coincidence. It suggests that even at the highest levels of the country's leadership, they are closely monitoring market cycles. Understanding whether the market is in an overvalued or undervalued phase is critical for planning the timing of profit-taking from illegally obtained crypto assets.
The single visit itself does not allow for identifying the user, but the context leaves no doubt. North Korea regularly appears in blockchain analytics reports in connection with the activities of hacker groups such as the Lazarus Group. They are attributed with the largest crypto thefts in history: the withdrawal of over $600 million from the Ronin network (Axie Infinity) in 2022 and the hack of the Coincheck exchange for approximately $534 million in 2018. For Pyongyang, under international sanctions, digital assets have become a crucial economic resource, and tracking market metrics is part of the strategy for managing these funds.
My comment: This incident is a clear confirmation that North Korean hackers do not operate blindly. They professionally use the same analytical tools as legitimate traders to assess market conditions. For the industry, this is a signal: even in the most isolated corners of the world, the crypto market is perceived not as a speculative toy, but as a full-fledged financial instrument requiring deep analysis.