Carreyou had two big revelations. One was that Theranos was not running blood tests on their proprietary machines, which were supposed to do finger prick draws. The other was that Theranos had submitted fraudulent validation data to the Center for Medicare and Medicaid Services (CMS) and state regulatory bodies.
They did a couple brazenly unethical and illegal things.
1) CMS subcontracts lab inspections to state regulatory bodies. When California lab inspectors visited Theranos, they physically blocked off the door leading to a floor that had the Siemens equipment, presumably to hide the fact that they were not conducting tests on their own proprietary machines. So, the inspectors never actually inspected the relevant labs.
2) Theranos violated "proficiency testing" guidelines. Proficiency testing is the practice of running tests on a sample with a known concentration/result, and comparing results. The spirit, if not the letter, of the guidelines is that you run the tests on the same equipment as would be commercially used. Thus, Theranos sent in fraudulent tests by testing using Siemens machines. This proficiency testing duping was what caused Tyler Schultz to send in an anonymous tip to the New York laboratory regulatory body, and led to his final decision to leave the company.
3) Theranos tried to claim with the FDA that its tests were "laboratory developed tests", i.e. they were unique tests that could not be compared to existing market tests. Carreyrou has a scoop in the book that Theranos benefited greatly from a bureaucratic power grab between the FDA and CMS. Both agencies claim some sort of regulatory oversight for the blood testing market.
At least initially, there were many in the FDA who were suspicious, and wanted to send inspectors. But, Theranos's seeming passing of CMS inspections allayed fears in the short term. It was after Carreyrou's first two articles (IIRC), that the FDA sent a surprise inspection.
EDIT: I also think that in the book Carreyrou mentions that a number of doctors in the Phoenix area, where Theranos was doing a test pilot of their finger prick tests, had filed complaints with the state or federal regulatory bodies. So, there were definitely people at CMS or FDA who were beginning to pay attention.