Following North Korean hackers: analytical tools of DPRK cybercriminals revealed
The analytical platform CryptoQuant has recorded a unique event: a user visit from an IP address belonging to North Korea. Attention to this incident was drawn not by the connection itself, but by the context — in a country with total internet control, such access to the global network is available only to a select few, which highly likely indicates a state agent.
A screenshot from the Amplitude analytics system reveals the details of the visit. The user navigated to the CryptoQuant page with the Bitcoin: MVRV Ratio metric via a Google search, using the Mac OS X operating system. This single activity alone does not allow for personal identification, but the geolocation by IP is a direct marker.
Why is this important?
In North Korea, access to the global network is a privilege for top leadership, military, and diplomatic structures. An ordinary citizen has no ability to access the internet, so this visit was almost certainly made by a professional hacker linked to state structures. Interest in the on-chain metric MVRV Ratio (market capitalization to realized capitalization ratio) from a North Korean agent is a signal that cannot be ignored.
Cryptocurrency as an economic resource for Pyongyang
North Korea regularly appears in blockchain analytics reports due to the activity of hacker groups. The most famous among them is the Lazarus Group. This group is attributed with the largest thefts in the history of the crypto industry: withdrawing over $600 million from the Ronin network (Axie Infinity) in 2022 and hacking the Coincheck exchange for approximately $534 million in 2018. For a country under strict sanctions, digital assets have become a critically important source of funding.
Expert opinion: The interest of North Korean hackers in fundamental metrics like the MVRV Ratio indicates that they are moving from simple thefts to strategic market analysis. This means their attacks are becoming more sophisticated and targeted. The market should prepare for new, more complex cyber threats from North Korea.