North Korean hackers have appeared in CryptoQuant: what they were looking for and why it matters
The analytical platform CryptoQuant has recorded a unique case: a visit to the site from an IP address belonging to North Korea. The user, who connected to the internet from one of the most closed-off countries in the world, was interested in the MVRV Ratio metric for Bitcoin. This observation, published on the service's official account, immediately attracted the attention of the professional community.
A screenshot from the Amplitude system reveals the details of the visit: the user navigated to the Bitcoin: MVRV Ratio page from a Google search query, using the Mac OS X operating system. This fact alone does not allow for identification of the individual, but the context is crucial. In North Korea, access to the global network is a privilege available only to a select few: government officials, diplomats, and military structures. An ordinary citizen cannot simply access the internet without special permission. Therefore, this visit highly likely indicates that it was made by a professional hacker or a state agent, rather than an ordinary user.
Intelligence toolkit: what the North Korean was looking for
The MVRV Ratio (Market Value to Realized Value) is a fundamental on-chain indicator that compares the current market capitalization of an asset with its realized capitalization (the average purchase price of all coins). It is used to assess whether Bitcoin is overvalued or undervalued relative to historical levels. Why might this indicator be needed by a representative of North Korea? The answer lies in the realm of strategic planning. North Korean hacker groups, such as the infamous Lazarus Group, operate with billions of dollars in cryptocurrency. Tracking macroeconomic market metrics is necessary for them to make decisions about converting stolen funds into fiat or other assets, as well as to assess the current phase of the market cycle.
The context is reinforced by a long history of cyberattacks linked to Pyongyang. In recent years alone, North Korean hackers are attributed with stealing over $600 million from the Ronin network (Axie Infinity) in 2022 and hacking the Coincheck exchange for $534 million in 2018. Digital assets have become a critically important economic resource for the country, which is under strict sanctions. Therefore, interest in analytical tools that allow for assessing the state of the market is not just curiosity, but an element of professional intelligence.
Analytical conclusion from Cryptalist. This incident is a vivid demonstration of how professional players, even while operating in the shadows, leave digital traces. North Korea's interest in on-chain metrics confirms that their operations have become more structured and analytically savvy. The market should consider that volatility may be driven not only by retail traders but also by state entities using advanced analytics to manage their cryptocurrency reserves.