But how would they track the movement of funds all the way through the Lightning Network? I thought each node involved in a transaction only knows the node immediately before and after it in the path?
most traffic goes through large public nodes and only involves a couple of hops. if you’re tracking the large, public node in the middle and you see 1M sats go in and 1M sats go out within milliseconds you can have high degree of confidence theyre connected
similar to how people are tracked through tor, ie timing attacks.