It seems that they mixed the stolen bitcoins with bitcoins that they withdrew from Coinbase. So law enforcement probably knew who they were from day 1. I feel that this is the time it took them to put together a case.

https://twitter.com/ErgoBTC/status/1283561433972846592?s=19