I was under the impression the KPN attacker merely used a single-hop VPN service from his KPN connection and the investigators managed to correlate traffic-flow

I was under the impression the KPN attacker merely used a single-hop VPN service from his KPN connection and the investigators managed to correlate traffic-flows. Unfortunate that talk is not publicly available.