The underlying technique is to consider addresses which were used together in a single transaction belong to a single wallet.
If you know some addresses from that exchange, like their own dummy accounts with used deposit addresses, they can tell which addresses belong to that exchange using that technique.
For the exchange's Hot/Cold storage wallet that aren't linked, it can be pinpointed by checking where the funds from the deposit addresses are being consolidated.

Everything is easy except if "ConJoin" was involved or the fund was mixed somewhere in the consolidation process.

With Monero or other privacy coins, it's almost impossible to track.