How could ERC-20 token movement be traced and partially mitigated after a theft on Ethereum?

I’m trying to understand, from a purely technical standpoint, how Ethereum transaction analysis is used after ERC-20 tokens are stolen.

In a case I reviewed, a recovery service (Scanner Hacker Crypto Recovery) claimed they assisted by:
• tracing token transfers across multiple wallets,
• identifying interaction points with centralized exchanges,
• documenting on-chain evidence for escalation.

I’m not asking about legitimacy or guarantees, but rather about what is technically possible on Ethereum:

  1. How is ERC-20 token flow traced across wallets and smart contracts in practice?
  2. What methods are used to identify exchange deposit addresses or mixing patterns?
  3. In what scenarios can on-chain evidence realistically lead to asset freezing or recovery (e.g., via exchanges or law enforcement)?
  4. Where are the hard technical limits where recovery becomes impossible?

I’d appreciate an Ethereum-focused explanation of the tools, techniques, and constraints involved.