North Korean Hackers: CryptoQuant Detected a Visit from a North Korean IP Address — Which Metrics Interest Them
The analytical platform CryptoQuant recorded a unique case: a visit to its resource by a user with an IP address registered in North Korea. This event, published in the service's official account, attracted the attention of the professional community, and for good reason. Given that access to the global internet in the DPRK is a privilege for the elite, not a mass phenomenon, such a visit almost certainly points to a state agent, not an ordinary citizen.
Visit Details: What Was the North Korean User Looking For?
According to a screenshot from the Amplitude analytics system, the visit parameters are as follows: page title — "Bitcoin: MVRV Ratio," referral from google.com, operating system — Mac OS X, country — North Korea. The post author suggested that on-chain analytics is now being handled by individuals close to the country's top leadership. If this guess is correct, interest in market metrics is being shown at the highest level.
By itself, a single visit does not allow identifying the user. Determining the country by IP address only indicates the network exit point, not a specific person. However, the context heightens attention to this event: the DPRK regularly appears in blockchain analysts' reports in connection with crypto hacker activity.
Cryptocurrency and the DPRK: Why Does This Matter?
North Korea is a closed and sanctioned country for which digital assets have become an important economic resource. According to a common version among researchers, cyber operations bring Pyongyang funds that are difficult to obtain through legal means. Several groups are linked to Pyongyang, the most famous of which is the Lazarus Group.
This group is credited with the largest crypto thefts in history, including the withdrawal of over $600 million from the Ronin network (Axie Infinity) in 2022 and the hacking of the Coincheck exchange for approximately $534 million in 2018. The North Korean authorities themselves deny involvement in such attacks.
Expert comment from Cryptalist: Interest in the MVRV Ratio metric from North Korean agents is not just curiosity. MVRV shows how overvalued or undervalued Bitcoin is relative to the average purchase price of coins. If Pyongyang is indeed tracking this indicator, it could mean they are coordinating their hacker attacks with market cycles, choosing moments to lock in profits or build positions. For investors, this is a signal: the actions of the Lazarus Group and other DPRK proxy groups could become an additional factor of volatility in the market.