People get busted because they're sloppy. DPR, for example. From what I've read, he made at least five major OPSEC errors.

- Back when SR1 was starting, he got a visit from the FBI about fake ID that he had ordered, shipped to his actual address in SF. And he basically admitted that he bought them from SR1.

- He posted to at least two sites about SR1, using accounts linked to his real name.

- Logs in a SR1 server pointed to an IPv4 address that he used in SF.

- Apache in a SR1 server was misconfigured, such that errors were accessible via clearnet, instead of via Tor onion.

- He worked in public with a FDE laptop, which contained everything about SR1. Including IDs for all staff. And he didn't take steps to enable emergency shutdown.

And about Bitcoin. One of my favorite mixing services, Bitcoin Fog, has handled huge amounts of Bitcoin, from various thefts. And nothing has ever been traced, to my knowledge.

Finally, where do you get "businesses trying to be legitimate"? Maybe their customers are legitimate, but why would you say that about the bot providers? They could just have a credible cover operation.

Sure. If your theory is that you can do crime perfectly, feel free to test it. That's a fantasy a lot of people have, but empirical evidence suggests that most of those people were wrong. And regardless, the ability to do anything perfectly gets harder as scale and scope increase, so I'm still comfortable saying that Bitcoin is best suited for small-scale crime.

As to the other bit: Bot providers need to be hired by somebody. If those people are legitimate businesses selling products or services, they will be traceable in the usual ways. It's those legitimate businesses that are of primary concern to lawmakers in this legislation and in most business regulation.