I'm guessing he fell for some internal honeypot, and that led to his immediate termination and subsequent monitoring. Then he also transmitted the honeydocs and the rest.

Sure they traced the crypto but that's not how they got him.