The comments from DarkSide hint that law enforcement requested access to the payment server and transferred from there.

https://twitter.com/BleepinComputer/status/13932171157008302...