Lazarus Group stole $37.3M from CoinsPaid via a 6-month social engineering campaign posing as recruiters. Attackers conducted fake job interviews and tricked an employee into installing JumpCloud Agent malware on their laptop, gaining access to operational systems and wallets.

Recently, Estonian encrypted payment service provider CoinsPaid said it suffered a cyber attack and $37.3 million worth of cryptocurrency was stolen. Although the attack caused significant financial losses to the company and had many adverse effects on the usability of the payment platform, the company stated that customer funds are still safe and the incident will not have a significant impact on the company's business. CoinsPaid said the attack was initiated by the Lazarus hacking group, and their goal was to obtain higher cash. On July 26, SlowMist tweeted that CoinsPaid, Atomic and Alphapo attackers may all be the North Korean hacker organization Lazarus Group.