1. it is hard to believe that ransomware hackers didn't mix their coins in first place to let something like Chainanalysis find out what they are doing with the funds. that should have been the first thing they did, and most probably it is. which raises the question about what the heck did chainanalysis find?
2. who sends nearly $1 million worth of bitcoin to an exchange, not to mention that it is illegal funds! normal people don't take such risks let alone criminals that know blockchain analyzers are looking at them and follow their transactions.
3. who leaves this much money on exchanges for such a long time (3 months)?
Don't underestimate human stupidity, all these hackers and malware spreaders aren't necessarily the brightest people, it doesn't take tremendous skill to compile a payload with other people's malware and setup some spamming server, or add it to some torrent. It's easy to judge people when you deal with Bitcoin every single day, but for someone who uses it for the first time, it's easy to make the mistake of putting all your coins into your exchange account, especially if you didn't read any guides prior to starting to use Bitcoin.