They use a shrinking pool of non-KYC off-ramps, recently they have been having worse luck at staying anonymous and their centralized exchanges are getting shut down. The era of crypto for ransomware is ending, the anonymity of the blockchain is a fading peculiarity of its early days. In practice, your transactions are even more traceable once enough of the centralized exchanges are brought into a regulatory framework and the bad actors are shut down (all happening now).
Recent news: * https://www.voanews.com/a/us-treasury-slaps-sanctions-on-cry...
* https://www.cnn.com/2021/06/07/politics/colonial-pipeline-ra...