Information recently surfaced that someone in North Korea has started mining bitcoin. According to Recorded Future, a threat intelligence company, on May 17 North Korea initiated a rather large mining operation. Prior to this date, there was minimal bitcoin node activity in the country.

The website said, “Before that day, there had been virtually no activity to Bitcoin-related sites or nodes, or utilizing Bitcoin-specific ports or protocols. Beginning on May 17, that activity increased exponentially, from nothing to hundreds per day.”

The website explored an intricate theory about why North Korea began mining bitcoin. They made a connection between the bitcoin mining start date and the timeline of the Wannacry ransomware attacks in May. The ransomware effectively encrypted over 75,000 businesses computers worldwide, and then asked for a bitcoin ransom in return for access to the files.

Apparently, North Korea started the bitcoin mining process to produce bitcoin activity within the country, so they can stealthily move bitcoin from the ransomware wallets around while preserving deniability of the attacks, according to Recorded Future.

This notion is not the only theory about the origin of Wannacry, though. According to reports from Financial Times and other media outlets, the Wannacry software is linked to the NSA exploits as well as the Shadow Brokers group. In this sense, there is no immediate, clear connection between North Korea and Wannacry aside from the present analysis by Recorded Future. Nonetheless, someone in North Korea is still leading a large scale bitcoin mining operation.