Just a guess for possible other steps:

-1. They acquired fake/stolen KYC credential

0 . Their collateral was anonymized

7. The investigation fails to uncover who it was.