Chainalysis traced this monero transaction: e4f525b214ef7310b53dd2e81be42801c7ee1a7c259ac0a093d813b493a788a8
The sender was: 98c88d7d6cee177fdd675763a51c451f36a3de026607fa5d7d1ed1eded0f5a1d
The recipient was: 2e9598dc6d1af0907297b395e71ff4cc7f38818893ccc90f7ff40fbec6820699
They also identify the change-recipient: 838bdcee6c15000a259f9f58172794a1a1bd132750f29aee1ed33bd7de94c85b
Then they follow the change to this tx: a5202cb022921d624d0e9a40a9d7e0cdc4d9cfeb0be11501414fe5a9c0cdd2a8
They got the sender's ip address from the fact that (1) when spending the change output created by the above tx (a520…d2a8), the target forgot to use a VPN (2) his wallet broadcasted the resulting transaction via a chainalysis spy node.
Having obtained the target’s ip address, Chainalysis sent it to police in Columbia, who arrested the target, allegedly a drug dealer. You can view the trace from 34:55---36:51 of this video: https://v.nostr.build/D4Nzp22vRF35IRnz.mp4