> the domain name expired

It's possible to tell from an rdap call that this isn't the case:

  Event:
    Action: registration
    Date: 1999-10-10T10:57:47Z
  Event:
    Action: expiration
    Date: 2028-10-10T10:57:47Z
  Event:
    Action: last changed
    Date: 2026-02-09T20:34:17Z

If it expired in 2025, then that expiration would have occurred in October.

That said, you are probably correct that it wasn't a hacker as such. GoDaddy was indeed offering it for sale in February, according to a Reddit thread from that month[0]. That makes me wonder why...

[0] https://www.reddit.com/r/oldinternet/comments/1qy566h/is_zom...