They purchased them on Binance, theoretically with a fully KYC'd account given that Binance tightly regulates large withdrawals (especially now after the DOJ coming after them).

I doubt this is just some hackers.