The linked affidavit has more of the interesting details. Looks like the agent worked with the guy's ISP and a well-known crypto exchange to do some old fashioned IP tracing.
Lotta crypto brokers look down on VPNs for obvious reasons.
But they seemed to have gotten their wallets mixed up and that gave away their identity on of one of the early 10k Bitcoin wallets.