Bitcoin mining activity suddenly emerges in North Korea, is the government the backer behind it?

Recent news shows that some people in North Korea have started mining Bitcoin. Threat intelligence company Recorded Future said that North Korea launched a large-scale mining operation on May 17. Prior to this, there was very little Bitcoin node activity in the country.

The website mentions:

Prior to May 17, there was virtually no Bitcoin-related website or node activity in North Korea, nor was there any use of Bitcoin ports or protocols. Starting on May 17, related activity increased dramatically, from zero to hundreds per day.

North Korea's connection to Wannacry ransomware

As for why North Korea started mining Bitcoin, the site has a complex theory. They link the date when North Korea's Bitcoin mining began to the timeline of the Wannacry ransomware attack in May. The ransomware invaded more than 75,000 corporate computers around the world and demanded Bitcoin as a ransom for the files to be returned.

Apparently, South Korea began a bitcoin mining process to generate bitcoin activity within the country, Recorded Future said, so they could covertly transfer bitcoins from ransomware wallets while also distancing themselves from the attacks.

However, this is not the only theory about the origin of Wannacry. According to the Financial Times and other media reports, Wannacry software is related to the NSA vulnerability and the Shadow Brokers organization. According to this theory, regardless of Recorded Future's analysis, there is no direct and obvious relationship between North Korea and Wannacry. In any case, someone in North Korea is indeed conducting large-scale Bitcoin mining activities.

Who is running North Korean mining rigs?

There are many different theories about who is operating these devices, but Recorded Future believes that it is likely the government.

It is unclear who is operating North Korea’s bitcoin mining rigs; however, given the country’s relatively small number of computers and its limited IP address space, such computationally intensive activity is unlikely to be conducted outside of state control.

In North Korea, it is almost impossible for ordinary people to connect to the Internet. The government cuts off most people's access to the Internet, and only a very small number of high-ranking military or government officials have access to the Internet. Most people can only access the country's intranet at times, which only has a few basic websites. This provides evidence to support the fact that the North Korean government operates mining equipment. However, at present, no one can draw any conclusions with certainty.