seems like the FBI was investigating for another unspecified reason, got the warrant for access to his cloud accounts, encountered encrypted files, and spent the next few months brute forcing or attacking the encrypted files until January 2022. they had marginal success with that effort but fortunately the files they got open were the jackpot with private keys and all sorts of damning things.
this is a strange one, because the IRS agent is the one that made the call.
so FBI, DOJ and IRS are involved.
The IRS agent actually suggested wire fraud and CFAA along with money laundering and defrauding the US (an IRS thing about revenue its owed), which makes sense, but DOJ has only moved on "conspiracy to commit money laundering" and "defraud the US".