The final stage of the operation involves exfiltrating cryptocurrency assets from compromised wallets to accounts controlled by the Lazarus Group. The transaction monitoring system detected a suspicious transfer of 50 BTC from a previously compromised wallet to an address associated with known malicious activity.