It seems very strange that chain and exchange hopping with multiple mixers attempts would be discovered by themselves. Either some had a KYC or the attacker bragged about the spoils.