Following North Korean hackers: what tools they use to monitor the market
The analytical platform CryptoQuant recorded a unique case: a user visit from an IP address belonging to North Korea. This event, captured by the Amplitude system, sheds light on which tools and metrics North Korean hackers operating in the cryptocurrency sphere are interested in.
A screenshot of the visit shows that the user navigated to the page with the Bitcoin metric: MVRV Ratio via a Google search. The system recorded the operating system as Mac OS X and the country as North Korea. The single visit itself does not allow for personal identification, but the context is crucial.
Why This Is Not a Random User
Access to the global internet in North Korea is a privilege available only to a limited circle of individuals connected to state, military, or diplomatic structures. Therefore, a visit from a North Korean IP address highly likely indicates a state agent rather than an ordinary citizen. Interest in the MVRV Ratio metric—a tool for assessing whether Bitcoin is overvalued or undervalued—suggests that hackers are studying market sentiment to plan their operations.
The MVRV Ratio (Market Value to Realized Value) compares the current market capitalization of an asset with the average purchase price of all coins. It is a key indicator for understanding whether the market is in an overheated zone or, conversely, undervalued. Why would North Korean hackers need such a metric? The answer is obvious: to choose the optimal moment for liquidating stolen assets.
Cryptocurrency as an Economic Resource for Pyongyang
North Korea regularly appears in reports from blockchain analysts regarding crypto hacker activity. The most well-known group is the Lazarus Group, which, according to a widespread version, operates under state control. They are attributed with the largest thefts in history, including the withdrawal of over $600 million from the Ronin network (Axie Infinity) in 2022 and the hack of the Coincheck exchange for approximately $534 million in 2018. Digital assets have become an important source of funding for Pyongyang amid strict international sanctions.
Expert opinion: The recording of a visit from a North Korean IP address to an analytical platform is not just a coincidence. It is confirmation that North Korean hackers have adopted a more professional approach: they are studying market metrics to manage risks and maximize profits from their operations. The market should prepare for such attacks to become even more sophisticated and complex.