deBridge is a cross-chain asset-transfer protocol that was targeted in August 2022 by attackers suspected to be North Korea's Lazarus Group. Employees received a salary-adjustment phishing email impersonating a company co-founder, with an HTML file masquerading as a PDF and a Windows shortcut disguised as a password text file. Execution triggered a script that checked for selected security products, collected information from Windows hosts, and enabled delivery of additional payloads, indicating an attempted cryptocurrency theft rather than a confirmed successful loss.