So who is behind the Coldcard exploit? Who is stealing all that Bitcoin?

I put the question to @Casa CTO @Jameson Lopp - who says it could prove incredibly difficult to pinpoint the perpetrators.

DPRK hackers?