Fortunately it was an incredibly inexperienced criminal. There are details about the Monero analysis, it is written on the report they lost track of the money

Fortunately it was an incredibly inexperienced criminal. There are details about the Monero analysis, it is written on the report they lost track of the money when it got sent to a monero wallet. How it was guessed: "KRP claims that by employing heuristic analysis involving educated guesses based on patterns and probabilities, they could infer the most likely path of the funds. The small amount, together with other funds, possibly from victim payments, was sent to a second Bitcoin address linked to the same email address, which was later found to be linked to an email server managed by Kivimäki." There isn't much magic here. In a small country is fairly easy to spot anomalies across bank accounts. That's it.