Anonymizing BTC is a lot easier than hiding from the SEC. There are that many people holding massive amounts of short-term TSLA options (enough to make >$500k on a single day movement) that the SEC can't look at each of them.
Also, you could filter for new traders and traders overly invested in TSLA. Giving the rather mediocre execution (i.e. single Bitcoin address), I doubt the attacker had a lot of time and capital upfront to hide in these masses.
Lastly, stock market transactions can be paused and are reversible - there's a good chance of a circuit breaker hitting or a reversal happening with that blatant market manipulation.
Keep in mind that a lot of the SEC's enforcement breadth comes from brokers' compliance departments. Any time anyone makes an unusual profit around corporate actions, the SEC basically requires a thorough investigation by the broker's compliance staff.
> I highly doubt that the SEC wouldn't put the required resources into this
I doubt they would not -> I think they would
Not sure I agree they'd have investigated thousands of people.
You and I and yesterday's Twitter hacker are not in this class.
Because prosecuting Elon Musk requires going up against top tier defense lawyers and proving things like "Musk tweeted this with the intention of impacting his stock's value" or something.
With hackers, you can use the financial stuff to target the hackers, and then either (a) prove the computer crimes or (b) use the computer crimes and the surrounding stock sales to prove intent. You also don't have to go up against a legal defense better funded than some militaries.
The SEC would be extremely motivated to find these people to make an example of them so others think twice in the future.