Maybe the attackers already knew through some other means that they had large crypto holdings, i.e., spear phishing.