Lazarus Group began large-scale targeting of financial institutions starting with the 2016 Bangladesh Bank $81 million theft case, subsequently shifting its primary targets to exchanges, DeFi protocols, and cross-chain bridges.