no way they just kept an unencrypted private key on the cloud.
Which is to say, this isn't how they actually got cought, it's just how the nail will go in the coffin (and thankfully for those impacted, some funds recovered).
FWIW, if you ever find yourself in this position of owning a large amount of stolen crypto, I believe the best way to wash it would be to "robin hood it out" to a bunch of random wallets. You just happen to own 10-20% of the wallets, but the feds now have to try and track thousands of different people over years to try and identify the true thief, and there will always be plausible deniability.
this is a strange one, because the IRS agent is the one that made the call.
so FBI, DOJ and IRS are involved.
The IRS agent actually suggested wire fraud and CFAA along with money laundering and defrauding the US (an IRS thing about revenue its owed), which makes sense, but DOJ has only moved on "conspiracy to commit money laundering" and "defraud the US".