We don't know how DPR handled opsec. There could be a file sitting on the server of every withdrawal pasted into his php app since day 1. He kept a record of a

We don't know how DPR handled opsec. There could be a file sitting on the server of every withdrawal pasted into his php app since day 1. He kept a record of a lot of things he claimed he didn't (PMs, transactions). The blockchain keeps these transactions forever, so even if they just have the private keys from his wallets they can figure out withdrawals. But I'm betting these guys were caught through plain text messaging in the internal system. Most likely they ordered stuff to themselves from another vendor and didn't bother to use PGP because most criminals are really terrible at being criminals.