They are notorious hackers and they have long history of sabotaging things when it comes to currencies especially dollars and now that they have found a way to infiltrate cryptos, they are mostly behind the hacking activities and attempt in the crypto exchanges. They are also hard to track due to their remote areas and I believe they have some people working for them outside their country.