Ah, that makes more sense. I'd be curious how what the timing is like between the compromises which give people access to keys or supporting systems and when the attacker does the noisy part of moving funds around.