North Korea’s notorious Lazarus Group appears to be behind the theft of $11.5 million from Taiwan-based cryptocurrency exchange BitoPro last month, the company revealed on Thursday. 

In an announcement posted on its website, the exchange said internal security teams and a third-party cybersecurity firm found that the methodology of the May 9 heist matched patterns seen in previous incidents attributed to the North Korean cybercrime syndicate, including thefts from global banking systems and major cryptocurrency services.

As with many North Korean cybercrime operations, the attackers employed social engineering tactics to gain access to company networks by targeting a BitoPro employee