NiceHash was described as a cryptocurrency-mining marketplace theft linked to Hidden Cobra, with the intrusion beginning through social engineering that impersonated a company system engineer and mimicked a Google Docs weekly-report invitation sent via an anonymous email service. Later indictment reporting tied the incident to North Korean RGB military hacking units known in security reporting as Lazarus Group and APT38, within a broader campaign of financial theft, cryptocurrency operations, and laundering of cyber-enabled proceeds.