Keyboard logging, located the key paper on paper or a pc, seized from exchange, or cracked whatever wallet software they where using seems more likely than cracking the encryption or beating it out of the suspects. Really the more time you spend around people actually using crypto coins the less secure they seem. It’s clearly possible to be secure, but many people are doing the equivalent of stuffing their mattress with cash.