Just doing that would be suspicious. Establishing a record of doing similar things for months to a year before the hack and THEN doing it, and continuing to do so for other stocks for a while after... well, then there'd be a LOT more plausible deniability.