> automatic custodial exchange are a thing, no user initiated withdrawal may have been necessary
It would have been necessary whenever the amount he deposited into the second exchange differed significantly from the amount he deposited into the swap service. I grant that the first time he did it, it's plausible that he did not withdraw the money; the amount he swapped was identical to the amount he deposited at the second exchange, so perhaps he just entered the second exchange's address as the recipient for his swap.
But if that is what he did, he clearly wisened up, because in the other three cases, he made the amounts vary a bit: once he sent a bit extra to the second exchange, the other times he sent a bit less. Indicating that he withdrew the money to a separate wallet first. So in all cases except possibly the first one, a user initiated withdrawal *was* necessary.
> whether there was an intermediate wallet or not, they nowhere claim to have visibility into any "withdrawal."
They mention the exact XMR amounts he received via the swap. That is insight into the withdrawal that they should not have had.
> it is not mentioned at all
Here it is:

Question: how did they know exactly how much he received via the swap? It wasn't the same amount he deposited into the second exchange. So they must have gotten that info from somewhere else. I think the first exchange *told* them how much money he received via the swap. Which means they got data they shouldn't have.
> nobody contests there was timing analysis done, but seeing Bitcoin go in and Monero come out isn't "tracing monero."
Seeing bitcoin go in is clearly tracing bitcoin. Seeing monero come out is clearly tracing monero.
> there is no "monero tracing" when their only monero data point is seeing coins arrive on the CEX
That's not the only data point. They saw the amount and time of two different monero transactions: the withdrawal from exchange A and the deposit to exchange B. That's not one data point, it's two.
> and if you dont like the word "apprehend", we'll use your word "find".
nowhere do they claim they "found" him by "tracing monero" (as they dont claim to trace monero at all).
They found him to be the launderer by means of this trace. The term used is the correct one. But if I change "they found the admin of Incognito Market by tracing his monero" to "they traced the monero of the admin of Incognito Market in order to identify him as a money launderer" will that be an improvement in your eyes?
