Tactics, Techniques & Procedures (TTPs): Increasingly utilizing AI-enhanced social engineering and automated vulnerability discovery to target DeFi protocols and cross-chain bridges.

Lazarus remains the most prolific state-sponsored financial threat actor in 2026. Their shift toward targeting Tendermint and Cosmos-based architectures (as seen in the THORChain incident) demonstrates a high degree of technical adaptability. They are no longer just 'bank robbers'; they are sophisticated protocol engineers who understand the underlying logic of decentralized systems better than many of the developers who build them.