This is an oversimplification, but it should give you a rough idea of how difficult it is to trace Bitcoin.
Granted, this is all theoretical. In practice, it’s not unusual for such people to make mistakes that reveal their identity; however, there’s nothing inherent to Bitcoin that ensures they can be de-anonymized.
Usually they attempt to go after hosting providers, but when the services are only accessible by Tor and they’re using bulletproof hosting—hosting providers who do their best to avoid law enforcement—that’s no easy feat. It’s not impossible, but it can be both a technical and diplomatic nightmare.
You'd be surprised. The feds have very advanced taint analysis if they have reason to go after you.
If the mixer has a lot of users, at best you could determine that the your target is among the entire set of people who used the mixer this hour/day. Although if the mixer was compromised, you’d have everything. That does seem like a substantial risk. It’s kind of like deciding to trust your vpn. You could mitigate that risk by using multiple mixers.
Perhaps they might do this if the saw keeping the entire 4m as much more lucrative than many years of taking the percentage skimmed off the top from a number of smaller transactions, and just going into "retirement".
Why would the mixer need to reuse addresses when you could create a brand new one each time.
Can you not track all Bitcoins going in and out of a mixer?