This hacker's modus operandi doesn't resemble that of a North Korean hacker; it's more like that of a trader with some understanding of trading logic. Because Binance ultimately needs to buy back the stolen coins to compensate users, the hacker dumped the market and then immediately opened long positions on Hype, waiting for Binance to buy back the ENA. This sounds very much like what a trader who frequently engages in event-driven trading would do.