But it's usually the case that following the money is the path.

So... have you actually tried to follow the money? You know, for science.
I traced some of the major solo addresses that showed up around the DDoS start to their Poloniex deposit addresses and reported them to a contact in law enforcement to see if there were any leads they could follow up on. Haven't heard back, but I wouldn't expect to. I posted about the analysis about six months ago.