There are other ways investigators could have connected activity to Ono. He may have used Nyaa without a VPN while logged into an account. Data from website cookies or content-delivery-network logs could also have been matched with Nyaa activity and tracker records. CODA has not said whether any of those methods were used.

VPN isn’t enough, you gotta worry about fingerprinting and cookies too. Recently it was revealed that Windows 11 has strong fingerprinting options that could be used to track you.

https://www.windowslatest.com/2026/07/10/you-cant-fully-disable-microsofts-gdid-windows-11-tracker-but-these-settings-limit-what-it-captures/

I wonder if they were using a VPN or seedbox. You could even do remote desktop into seedbox and browse the sites from there.