It's even more stupid. The ransom was paid in Ether (ETH) which the kidnappers then exchanged to Tether stablecoins (USDT). Tether is a centralized company that can freeze and block any blockchain address from using the stablecoin that they issue and that's exactly what they did, they froze the ransom.
We'll probably have more details about this in a few days just goes to show how you can't hide on public blockchain ledgers.
I’m gonna go out on a limb and say that ransom was paid and that’s how they were able to locate the Ballands.