At first glance, exchanging Bitcoin for Monero makes sense. But why use Monero with an exchange, which is likely to help the police? (And which did.)
Monero transactions are private only on the block explorer. The sender has a key (view key) that allows one to view to whom and how much was sent.
So, what’s the point of using Monero in that case, rather than something that would resist investigators, like Zcash ?
In the example you are referring to, the WannaCry attackers used Shapeshift to convert Bitcoin for Monero.
Shapeshift would have access to the sending Bitcoin address (known publicly as the WannaCry address), the IP address that accessed the website, the known given outputs to the Monero address, and the receiving Monero address. Minus a few other points of metadata, that's about it.
For Zcash, the leaked data would have been essentially identical if sent to a z-address. However, since Shapeshift does not support sending to z-addresses, Shapeshift would have also had access to when the attacker moved funds from the t-address (and to where - either another t-address or some z-address).
There is no way for Shapeshift to know for certain when the funds are spent on Monero. They know which transactions use the same outputs, but these outputs are likely used in several transactions. Furthermore, the attacker could send Monero to themself to increase the output anonymity set. Investigators are likely looking at how the outputs have been transferred on the blockchain by these different participants over time. They hope to narrow down the anonymity set based on user behavior.
You mentioned the view key, but Shapeshift presumably does not have the view key of the attacker's Monero wallet.
The private view key does not let you see to whom and how much was sent. The private view key let you see how much incomes to an account (wallet).
Only the private spend-key can show the amounts of transactions. Even the destination will be unknown from a wallet created from an import of the spend-key.
And moreover, those keys are private. So unless you share them with authorities, there is no way for them to get those informations.
