They buy from OTC desks. The OTC desk is in contact with miners, whales or other entities holding hundreds, if not thousands, of bitcoins. The OTC desk agrees on a transaction at a spread over the reference rate between buyer and sellers.
Then they cross the order on the market.
So the transaction actually happens on the market (e.g. Coinbase) even if the price hasn't been formed on the exchange itself, but Over The Counter (OTC).