The lynchpin to retrieving $2.3 million, half the company's payment, was gaining access to the private key linked to the attacker's Bitcoin account. Here's how authorities may have gotten it.