If they were dumb enough to waste such a high value target on a small scale bitcoin scam then I wouldn’t be surprised if they were dumb enough to perform the malicious actions from their home IP address.
What else could have been done other than crypto scam to get away without being caught ?
Didn’t the hack need internal access? VPN maybe?
Sure, but if they connected to the VPN from their own IP, then that's not going to hide anything.
Is connecting to a VPN through another secure VPN doable/benefit?
Doable, although annoying to configure correctly. Beneficial if you want to obscure your identity from the second VPN server (i.e. Twitter's, in this case, which ought to be logging connections)