North Korean hackers exposed themselves by analyzing on-chain metrics: details of the visit to CryptoQuant
The analytical platform CryptoQuant recorded an unusual visit from a user whose IP address belongs to North Korea. This case sheds light on the tools and data that North Korean hackers are interested in and confirms that their activities are far from random.
How the trace was detected
According to a screenshot from the Amplitude analytics system, the user navigated to the Bitcoin: MVRV Ratio metric page via a Google search. Their operating system is Mac OS X, and the country is North Korea. Given that access to the global internet in the DPRK is strictly limited and granted only to a select few—mainly state, diplomatic, or military structures—this visit highly likely points to a professional hacker rather than an ordinary citizen.
What is MVRV Ratio and why do hackers need it
The MVRV Ratio (Market Value to Realized Value) is a key on-chain metric that compares an asset's current market capitalization to its realized capitalization (the average acquisition price of all coins). It is used to assess whether Bitcoin is overvalued or undervalued. Why would a North Korean agent need this particular indicator? The answer likely lies in macroeconomic analysis: hackers study market cycles to choose the optimal time to liquidate stolen funds, minimizing losses and avoiding drawing excessive attention.
Context: North Korea and cryptocurrencies
North Korea has long been a major player in the world of crypto crime. Groups such as the Lazarus Group are linked to the largest thefts in history: the theft of over $600 million from the Ronin network (Axie Infinity) in 2022 and the hack of the Coincheck exchange for $534 million in 2018. For Pyongyang, under strict sanctions, digital assets have become a critically important source of funding that is difficult to obtain through legal means.
Cryptalist Analysis: A single visit in itself does not prove a direct link to state structures, but it perfectly illustrates the evolution of North Korean hackers' tactics. They are moving from crude hacks to deep market analysis, using professional tools to manage their crypto assets with maximum efficiency. This is an alarming signal for the entire industry: the enemy is becoming not only bolder but also more analytically sophisticated.