Interesting bit from the court docs of how they traced it to him:

Based on cryptocurrency tracing analysis performed by FBI personnel, I have learned the following, among other things: on or about November 12, 2025, and November 13, 2025, in a total of approximately three transactions, Wallet-0xAf6 sent a total of approximately $149,980 of cryptocurrency to particular cryptocurrency swapping service (“Swapping Service- 1”).2,3 Based on documents from Swapping Service-1, I have learned that shortly after those three transactions, Swapping Service-1 sent approximately $149,980 of cryptocurrency to a particular cryptocurrency payment processor (“Payment Processor-1”). Based on documents from Payment Processor-1, I have learned that the November 12 and 13, 2025 transactions were received by account in the name of “Michele Spagnuolo,” and that an Italian Government identification card was used to open the account at Payment Processor-1. A copy of that identification card, which I have reviewed, appears to be a government identification card for MICHELE SPAGNUOLO, a/k/a “AlphaRaccoon,” the defendant.

Seems like whatever swapping service he used is what got him as he probably assumed that they wouldn’t comply with law enforcement or have detailed records.