FinNexus reported that its ERC-20 contract appeared to have been hacked, while some users alleged the event may have been a rug pull by the project itself. Later on-chain research by ZachXBT included FinNexus among cryptocurrency thefts traced to Lazarus Group, also described as Bluenoroff or APT38, and mapped stolen-fund movement through intermediary wallets, mixers, cross-chain services, exchanges, and OTC facilitators.