TRM Labs and Chainalysis both suspected that the hackers were part of an elite, state-backed North Korean hacking group known as TraderTraitor.