Law enforcement says it was able to seize the 94,636 Bitcoin left in the wallet because Lichtenstein allegedly uploaded a list to a cloud storage and email provider that contained addresses for the wallet that Binfinex’s funds were dumped into, along with the private keys to access them. The file was encrypted, but after obtaining it through a search warrant, the statement of facts says that law enforcement was able to decrypt it and several other files (though it doesn’t offer any explanation of how).
Mitchell Clark
https://www.theverge.com/2022/2/8/22923772/doj-irs-bitfinex-hack-bitcoin-recovery-encrypted-files-razzlekhan