They purposely don't give the details of their craft, but likely they found through chain analysis which exchange the coins went to (maybe after some mixing or not, who knows). Then it was simply a matter of seizing those coins from the exchange. If the exchange was not in the U.S., they probably coordinated in law enforcement in whatever country the exchange was located.

Now if there was mixing done, there probably was only an X% chance (e.g., 90% chance) that they had the correct post-mix coins. There very well could have been an innocent person who used the same mix method as the ransomware scammers and the USG took the innocent persons' coins because ... they can. But we'll probably never know what the truth actually is.