According to CoinMeta, a crypto practitioner Clemens stated that their device was subjected to a social engineering attack in December 2024. The attacker impersonated a contact they knew offline, invited them to a Microsoft Teams call, and tricked them into clicking on a software update link under the pretext of an "audio fault," thereby installing malware. Clemens mentioned that although they deleted the files and scanned for viruses multiple times afterwards, about 21 months later when they had not fully restored the device to its factory settings, the malware became active again and took control of the computer. As a result, approximately 8 years of Telegram chat records and contact information were obtained by a hacker group associated with North Korea.