they did what tracing they could (since they had the private keys and all)

heres a link to the postmortem

https://moonstoneresearch.com/2023/11/03/Postmortem-of-Monero-CCS-Hack.html