Analysts at CryptoQuant have detected a North Korean hacker: the tools used have been revealed.
The world of cryptocurrency analytics has received unique evidence of how North Korean hackers interact with market metrics. The CryptoQuant platform recorded a visit from a user with an IP address belonging to the DPRK to a page displaying the MVRV Ratio indicator for Bitcoin. This case sheds light on the working methods and interests of state-sponsored cybercriminals.
According to data from the Amplitude system, the visit was made from the Mac OS X operating system, the transition was made from google.com, and the country of origin was North Korea. A single visit in itself does not identify a person, but the context is crucial. In the DPRK, access to the global network is a privilege available only to a select few associated with state, military, or diplomatic structures. Thus, a visit from a North Korean IP almost certainly indicates a state agent.
Why do hackers need the MVRV Ratio?
The MVRV Ratio (Market Value to Realized Value) metric compares the current market capitalization of an asset with the average purchase price of all coins. It is used to assess whether Bitcoin is overbought or oversold. Why would hackers, known for stealing billions of dollars, monitor this indicator? Likely for strategic planning: understanding market cycles allows them to choose optimal moments to liquidate stolen funds through mixers and exchanges, minimizing losses from volatility.
The DPRK regularly appears in blockchain analytics reports as a hub of cybercrime. Groups like the Lazarus Group, linked to Pyongyang, are behind the largest thefts in crypto industry history: the $600 million Ronin hack in 2022 and the $534 million Coincheck attack in 2018. For a country under sanctions, digital assets have become a critical economic resource.
Expert opinion: This case is not just a curiosity but a signal for the industry. North Korean hackers are moving from brute force to analytics. They study the market as deeply as institutional investors. This means their money laundering operations are becoming increasingly sophisticated and difficult to trace.