How it was found that the Dao hackers used shapeshift?
In a more practical exemple, how to find that
13qCK9VzJCicXeh47W59rh7A6tfun92Sr5 belongs to https://www.blockchain.com using only block explorer data?
There is no guaranteed way to check.
In most investigations, it is a combination of tracing the money to known addresses (most exchanges and companies consolidate funds into a handful of hot and cold wallets), and exchanges volunteering/sharing information when served with warrants.