It's hypothetical. There is no difference between those two scenarios, we could also just assume the hacker pulled it out of their ass...