Mh, as hinted I'm not part of the core team, so I cannot say anything definite, but a lot of money is going into bug bounties: https://www.bountysource.com/teams/elementary/bounties (a blog entry from february talks about $15,000 total in bounties and $3,470 to upstream projects). These bug bounties are paid out to contributors solving nasty bugs, but it's open to everyone to solve these bugs and get the bounties.

Currently there is only one person really employed by elementary LLC (and paid regular), and that's Daniel Foré, the project lead. He quitted his job, but from what I understand, he earns significantly less than in his job before. Everyone else is "only" getting money from bug bounties.