Nexus Mutual founder Hugh Karp's wallet was drained of 370,000 NXM tokens, which were converted into wrapped NXM and sent through attacker-controlled Ethereum addresses. Later analysis included Nexus Mutual among cryptocurrency thefts traced to Lazarus Group, also described as Bluenoroff or APT38, and Big Phish contextualized the activity within DPRK-affiliated actors' financially focused cryptocurrency operations.