Can't law enforcement follow the transactions of the public address of the ransom bitcoin wallet until the bitcoin is sold?
And the cops can go and track each individual person from that pool if they really care. Even if we are talking about thousands.
Remember the story from a few days ago where to track a possible spy they went through all glasses prescriptions from a city.