Aren't most exploits that get used, shared through black markets anyway? So Saying Xcountry-linked hackers, is just saying who ponied up the bitcoin to pay for

Aren't most exploits that get used, shared through black markets anyway? So Saying Xcountry-linked hackers, is just saying who ponied up the bitcoin to pay for the attack?