According to CoinMeta, a contributor with the username tanuki42 has compiled an analysis of North Korea's cyberattack tactics against the cryptocurrency industry. They noted that the term “lazarus” is currently a general designation for North Korean cyber operations, but in reality, there are multiple organizations with different attack methods. Among them, tradertraitor / jade and sleet mainly target developers through highly targeted fake job offers and programming test attacks, and have been involved in large-scale attacks such as bybit and ronin. applejeus / citrine and sleet have evolved from using early Trojan trading software to long-term identity fraud, and even carry out social engineering at offline meetings. dangerouspassword / cryptocore make extensive use of stolen telegram accounts to send calendly, zoom or teams links, enticing targets to install malware. contagious / interview and famous spread malicious code by mass distributing fake job offers and programming tests, while North Korean IT operatives infiltrate cryptocurrency companies under fake identities and launch attacks after gaining internal access.