DPRK-nexus actors stole $2.02 billion in digital assets from cryptocurrency exchanges and fintech platforms in the documented period, leveraging supply chain compromise and valid account abuse. Ransomware operators are simultaneously targeting the same financial sector infrastructure with DLL hijacking and session cookie abuse. These two threat clusters require different detection strategies on overlapping infrastructure.