From the article it shows the kids had bad opsec, and their identities could be deduced from Github accounts that were linked to the theft which were subsequent

From the article it shows the kids had bad opsec, and their identities could be deduced from Github accounts that were linked to the theft which were subsequently subpoenaed. edit: And since they were asking on github on how to get the private key from the malware, they apparently succeeded in getting that private key and then probably sent the coins to bitfinex. That transaction would be visible on the chain of course, so it's an independent thread of evidence.