As expected, the hackers were familiar with Binance's strategy, knowing the exchange would immediately buy back the stolen tokens. Currently, the addresses linked by the hackers are heavily invested in altcoins such as PEPE and ENA, which are major cryptocurrencies on Ethereum. I don't recall North Korean hackers using this tactic before; this is a sophisticated operation.