We all know it's possible to track a wallet to an IP address. Colonial Pipeline worked with the FBI from the start. The FBI is obviously running their own nodes to be able to track transactions to IP addresses and this is how it was tracked down to the US based cloud server. I'm guessing these hackers used a US based cloud server to avoid firewall/geo-filter rules from many firewalls. (I know we block all non-US IPs on our network).
This is possible but using a VPN before writing a new transaction into a blockchain is a standard step, which every script-kiddie is doing as well. So, I don't think that this explanation is the right one.
I know a special FPGA-based device which is called Copacobana (Cost-Optimized Parallel Code Breaker:
https://www.copacobana.org) it was developed in Germany back in 2007 and was able to brute force 65 billion keys per second. This pace gives the attacker a right key after 6-13 days (58bit DES encryption). Source (Wikipedia, sadly written in German):
https://de.wikipedia.org/wiki/CopacobanaHere in Bitcoin-Land, a private key has a length of 256 bits, which is significantly longer and increases the number of possibilities exponentially... But, Copacobana was the first code-breaker of its kind built with FPGA-Hardware back in 2007, today they have Rivyera which main strength is its massive scalability to other Rivyera-Engines:
https://www.sciengines.com/.
So, In my opinion the private-key was brute-forced by the FBI/NSA or other organization which can afford a datacenter filled Rivyera-Engines+electricity costs.