Getting tips from criminals is not sloppy sourcing. There is verification that obviously failed here. We likely won't hear the full story until the prosecution and litigation cycles have turned.
But the fact that the source was also the person who has allegedly perpetrated the crimes going unmentioned and not being disclaimed to me is sloppy - even if there was additional verification done, if you are mentioning this source as the cornerstone of your article, I want to know about the vested interests that source has. Obviously, being the person that allegedly did it means you have A LOT of vested interest in how it is covered and what is revealed. If you want to talk yourself up and brag about it (which seems to be a given if you are telling a journalist about something you allegedly perpetrated) it is totally reasonable for people to be suspicious about how much is fact and how much is fiction. Humans like to exaggerate when talking themselves up.
Most do a lot more source verification than Krebs these days, dropping/shelving stories if they can't find corroborating evidence.
Which leaves a lot of crap out there.
And most of the industry is busy trying to stay afloat and shoveling whatever random thing they can find. Only the top couple percent has the luxury of taking or leaving something juicy (if it isn’t obviously a trap).