Analytical tools of North Korean crypto hackers: CryptoQuant recorded a visit from the DPRK
The analytical platform CryptoQuant has detected unusual activity: a visit from a user with an IP address registered in North Korea. This case sheds light on which specific analytical tools are of interest to hackers from the DPRK.
By itself, a single IP address recording does not allow for identifying the user. However, context is crucial. In North Korea, access to the global network is a privilege available only to a select few: government officials, diplomats, and the military. Therefore, a visit from a North Korean IP with high probability points to a state agent, not an ordinary citizen.
According to a screenshot from the Amplitude analytics system, the user navigated to the CryptoQuant page from a Google search, looking for data on the MVRV Ratio (Market Value to Realized Value) metric. This indicator compares Bitcoin's market capitalization with its realized capitalization, allowing an assessment of whether the asset is overvalued or undervalued relative to the average coin acquisition price. Why this metric was needed by a North Korean agent remains a mystery.
Context of the cryptocurrency threat
This observation reinforces a general trend: the DPRK regularly appears in blockchain analytics reports as one of the main sources of cyber threats. According to a widely held view, cyber operations bring funds to the closed and sanctioned country that are difficult to obtain through legal means. Digital assets have become an important economic resource for Pyongyang.
The most well-known group associated with the DPRK is the Lazarus Group. It is credited with the largest cryptocurrency thefts in history, including the withdrawal of over $600 million from the Ronin network (Axie Infinity) in 2022 and the hack of the Coincheck exchange for approximately $534 million in 2018. The North Korean authorities themselves deny involvement in such attacks.
Expert opinion: The use of fundamental metrics like the MVRV Ratio indicates a high level of professionalism among North Korean hackers. They do not just hack wallets but carefully analyze market cycles to choose the optimal moment for liquidating stolen assets. This transforms them from simple thieves into serious market players capable of influencing short-term price dynamics.