CoinsPaid attributed suspicion for its July 22, 2023 theft of USD 37.3 million to Lazarus based on tactics and laundering patterns resembling the Atomic Wallet heist. The company said the attackers spent about six months probing CoinsPaid with social engineering, phishing, brute-force and DDoS activity before tricking a critical employee through fake recruiting and technical-task lures into installing software that enabled access to internal systems. The campaign targeted cryptocurrency operations rather than a simple web exploit, using detailed knowledge of staff and infrastructure to make the pretext credible. CoinsPaid and Match Systems traced the intrusion and subsequent fund-laundering services so other crypto providers could understand the attack path.