How do they know that those BTC went to exchanges? The probably can check which BTC went back to Mt Gox, but how do they know that a particular receiving address belonged to e.g. Bitcoinica?
One probable method would be to look at the addresses that other people used to deposit to an exchange. Many people make this public, for various reasons.
I assume the investigators would see a pattern of many small deposits being moved directly from those deposit addresses into the exchange's hot and cold wallets, which contained large amounts of money. That pattern could be recognized and the exchange's main wallets identified beyond reasonable doubt. Withdrawals from the exchange could also be tracked, I assume. Probably there is more sophisticated analysis of addresses clusters involved too.
