Some informations missing to people when reading the Vastaamo hack:

• The hacker leaked it’s identity (source)
• Then the identity leak were used to find it’s crypto-accounts such as binance, where he deposited amounts correlating with the investigations (source)