It's pretty odd that the hackers wouldn't require payment in Monero or even ZCash rather than Bitcoin, since it's somewhat difficult to cash out BTC without it being obvious where it came from.