It seems very strange that chain and exchange hopping with multiple mixers attempts would be discovered by themselves. Either some had a KYC or the attacker bragged about the spoils.

The indictment[1] mentions that he used a VPN. Given how they seem to have gotten his search history from multiple months he probably made the queries using his google account. I didn't find any mention of what got him caught but I would assume that they either traced the trail of stolen crypto to some exchange where he had traded them for FIAT or maybe the VPN he used was one that kept logs.

1: https://www.justice.gov/d9/2023-07/u.s._v._ahmed_indictment....