That's where I knew something isn't right, they were all apprehended because the 25yrs old guy moved the Bitcoin back to a centralised exchange where he already passed his KYC.
If the 25-year old moved the coin directly from the criminal friend of his directly to a Cex without routing it to his noncustodial wallet, I think that was a bad move. Who knows, it could even be that the coin was transferred directly from where it was stolen to a Cex. Sorry, those parts weren't detailed out and I'm trying to figure out how they were exposed. I like it when criminals are caught and dealt with.
Again, I think the 25-year old was lured into the deal because of the discount he was offered. He may not be that innocent as we perceive him to be. Anyway, the take home for me here is if something sounds too nice to be real, investigate it. Don't be too fast to jump on the offer.