So wait - lemme get this straight.

They tracked him via Gyft and an American(!) VPN; where he had used his real name, email and home address purchased with the stolen BTC? Which, by the way, were all stored on Dropbox account along with a spreadsheet of all his activity?