Analysts at CryptoQuant detected a North Korean hacker: here are the metrics he was studying
Recently, the on-chain analytics platform CryptoQuant recorded unusual activity: a user with an IP address belonging to North Korea visited a page featuring the MVRV Ratio metric for Bitcoin. Given the strict internet access restrictions in North Korea, this visit highly likely indicates the activity of professional hackers rather than ordinary citizens.
Visit Details: Mac OS, Google, and MVRV
According to a screenshot from the Amplitude system, the visit was characterized by the following parameters: operating system Mac OS X, a referral from a search query on google.com, and the target page being Bitcoin: MVRV Ratio. The author of a post on X (formerly Twitter) suggested that this visit was made by a representative of the country's top leadership, who is now personally interested in market metrics. However, it should be emphasized that identification by IP address only indicates the network exit point, not a specific individual.
Why It Is Likely Hackers
The context leaves no doubt: access to the global internet in North Korea is a privilege available only to a limited circle of individuals connected to state, military, or diplomatic structures. Therefore, a visit from a North Korean IP almost certainly results from the work of a state agent, not an ordinary user.
Cryptocurrency as an Economic Resource for Pyongyang
North Korea has long been a key player in the world of crypto crime. According to numerous investigations, cyber operations, including exchange hacks and theft of digital assets, have become one of the main sources of funding for the country, which is under strict sanctions. The most well-known group linked to North Korea is the Lazarus Group. It is credited with high-profile crimes such as the theft of over $600 million from the Ronin network (Axie Infinity) in 2022 and the hack of the Coincheck exchange for $534 million in 2018.
Analyst Comment: The interest of North Korean hackers in fundamental metrics like the MVRV Ratio suggests that their approach is becoming more professional and analytical. They are not just stealing assets but also trying to assess the market situation to choose the optimal time to liquidate stolen funds. This increases risks for the market, as Pyongyang may act more coordinated and effectively.