It's hardly surprising that these people are being caught. Using a VPN service that resides primarily in the USA, the same jurisdiction in which your attacks are being carried out, seems a bit shortsighted.
They could have picked any other totalitarian police state in the world, Russian, Chinese proxies, they all accept creditcard, and the FBI could have done fuck all to get the logs.
Instead you know USA based companies are required to barf up the logs at the drop of a hat.
It's not just lazy, it's really really dumb.