Coinbase.

Coinbase denies involvement after FBI seizes Bitcoin from DarkSide ransomware crew

"Good ol' fashioned police work to locate the target servers, and an MLAT request"?