Authorities have not disclosed further details about their on-chain analysis, but they were able to trace the crypto trail to Kivimäki's bank account.

https://cointelegraph.com/news/finnish-authorities-traced-monero-vastaamo-hack