They are vague about the details.
Most likely got them as they left Monero (offramping onto an exchange or naively swapping in and out of transparent crypto) like all these articles claiming to have "traced" Monero.
Makes for good clickbait though