Blockchain observers say North Korea was behind the record-breaking theft, while an Ethereum upgrade helped one attacker-controlled contract drain billions in minutes.