The “legitimate” part of the business (which was at least going through the motions of cooperating with the authorities) was transferring coins into the cold wallets, so they had to know the wallets’ public addresses. As I understand it, you need the private key (which he of course had secured) to transfer money out of a wallet, but that when you do so, anyone can tell that you’ve done it.
Reported.