2/3 a state-controlled malicious mining pool running a modified full node working on a separate branch trying to outpace the rest of the network before broadcasting it out as the longest chain in order to “break” .  Seems legit.