According to the Japan Government, a common mode of attack for the Lazarus Group was phishing, who are believed to have focused more on crypto funds lately because they’re “managed more loosely.”
North Korea’s Lazarus behind years of crypto hacks in Japan: Police