So most likely,
1) they didn't launder it properly, leading to police being able to trace it to their bank accounts. I wonder if tornado.cash was used.
2) then police had their names, leading to warrants for all online accounts - google account, apple account, etc.
3) they made the big blunder of keeping their private keys in their online account. Most likely a txt file in google drive. That is such a silly blunder. Without the private keys, the police has zero proof of anything. They could have made a hundred excuses for how they got money in their bank account, as long as the police didn't have the private keys. Who keeps their private keys in an online account?
Apparently the biggest criminals make too many silly mistakes. The old saying applies here: "you don't have to be smart, just don't be an idiot"
Proving this is hard by design, but a good example of that would be how they used the Hansa market as a honeypot by running the market themselves for months.
The entire investigation around Alphabay and how they got to the owner is a bit shady, too, and there have been tons of rumors of the entire official case being based on ad-hoc parallel construction.
Shortly after he committed suicide I pulled up the French language technical board where he had linked an alias to a real email address. Which mirrors the same mistake as the Silk Road operator.
When you dig deeper into these cases it’s clear that they aren’t properly washing the money. There’s no placement or layering. They go straight to laundering on a public ledger and cash out under their own names.
The simplest explanation is usually the correct one.