According to this article they got the hacker's private key: https://californianewstimes.com/us-says-it-has-recovered-large-portion-of-colonial-pipeline-ransom/383269/
Unclear how, but it mentions some servers being seized, so maybe they got access to a physical device. Or perhaps they got malware onto the device or there was a cooperating exchange.