Yeah despite the FBI trying to play coy and pretend they are masters are investigation, the DarkSeid crew themselves mentioned that their "payment server" was seized, which leads me to believe that it's scenario #2 (DarkSeid having a rented server containing their wallet) mentioned in the article that led to the Federal Bureau of Matters being able to recover the coins. I'm still confused as to why they'd bother with a hotwallet for this sort of thing though.