North Korean cybercriminals stole $308 million in virtual funds earlier this year after infiltrating a Japanese cryptocurrency exchange’s systems through an elaborate social engineering campaign, according to U.S. and Japanese authorities.

In a press release on Monday, the FBI, the U.S. Department of Defense Cyber Crime Center and the National Police Agency of Japan attributed the theft of 4,502.9 bitcoin from DMM Bitcoin in May to TraderTraitor, a cryptocurrency-focused threat cluster associated with North Korea’s Lazarus Group.

Also known as Jade Sleet, UNC4899 and Slow Pisces, the group often carries out targeted social engineering campaigns against multiple employees of the