There has been some chatter by those sleuthing the sleuthers, but I don't follow it closely.

What the authorities and these chain analysis orgs tell us they did (which sounds like magic) is certainly in actuality where they had KYC exchange data and high value amounts that didn't correspond with that person's story (also known as a lifestyle audit). So they then observe more closely and if more shady stuff found, then they start to make links, very likely using data collection methods like subpeonaing the couple's accounts and hacking their devices (if needed) or whatever, to know if their suspicions were actually on to something. Just that in this case it, allegedly, led to a monster size theft.

Who knows.

Moral of the story, if you make yourself a target, you will be targeted.