It is a fair point but you can't buy bitcoin these days without kyc, not to say the IP trace, if they can break tor/proxies and access exchanges records they can "follow the bitcoins", but then again how much funding you need, in EU recently there were quite a few attacks where they just rented a big truck and ran over people, also the bomb in the airport, they made it from some cheap chemicals, and then took a cab.