This was a multi-country investigation. The USA were likely already aware of Coelho so when he entered the US, he was then arrested by US authorities upon landing. It doesn't say his devices were searched there and then. It said a warrant was obtained to search his device, so they would needed to have a valid reason to apply for that warrant.

You seem to be reading it as if they had no idea who he was and they randomly searched someone's electronic devices and just happened to be this guy. That's not what they're saying happened?

That’s not what the text really suggests. It very clearly states:

> The government obtained a warrant

Which obviously means that he wasn’t randomly searched at the border, but the government knew who he was.

It’s not parallel construction, just poor wording by Krebs.

Edit: Breaking news is that the card is indeed believed to be from the attacker. Aside from photos on social media, the suspect also left behind a bag of other weapons and a key to a U-Haul van. I'm guessing the card may have been in said bag. I'm not really sure there is much to suspect parallel construction here.

Unless they meant he left it as a calling card, which I don't think they did, I don't see why that is suspicious, just another example of not having to make a single mistake.

The middleman service used his personal, verified, Coinbase account. The raidforums domains were his customer service website and contact emails for Coinbase, Kraken, and PayPal. His personal gmail used recovery@raidforums.