This article states that it is not known how the FBI obtained the private key of the address with the ransom in it. Can't find any other sources on this. Are there any theories or evidence of how this was done?
Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. It only takes a minute to sign up.Sign up to join this community
It seems that the FBI seized their servers and found the private keys there.
If you wanted to know if there was a flaw in Bitcoin software or the protocol, there is no evidence of that.
The latest news indicates that ransom's bitcoins were deposited in a California based custodial address (an exchange or wallet provider) and the FBI seized it with a DOJ warrant.
So (astonishingly) it seems that the hackers lost their bitcoins because they used a custodial wallet (U.S. based) instead of one they had the private keys for.
The transactions flow also seems very easy to track: it is possible to do it by anyone even without knowing the ransom's address, knowing only its amount, as shown here: