Euler Finance’s efforts to recover nearly $200 million in stolen crypto hit yet another wrinkle Tuesday after a wallet linked to North Korean hackers tried to swindle the DeFi protocol’s exploiter.

The so-called “Ronin bridge exploiter,” which last March stole $625 million worth from crypto game Axie Infinity, sent an on-chain note to Euler’s exploiter asking it to decrypt an encrypted message. But according to experts CoinDesk spoke with, the message was a phishing scam attempting to steal the credentials for the Euler exploiter’s wallet.