Well, the CIA appears to have quite a history of incompetency.
But given how insecure digital communication is, the IP addresses of everyone who is a member of 'The War Room' will have been located. Yes, fast IP-hopping and using a 1-time pad IS possible, it's difficult for anyone but a nation state to avoid long-term traffic analysis.
So who knows, as I mentioned before, he was arrested by the BSIJ, an elite unit that is more military than civilian in structure and on of the four classes of crime they are tasked with policing human trafficking and cyber crime are two of them.
We know he's behind at least three cryptocurrency scams. Here's the most recent:
Of course their are theories that someone else is using him as a fall guy but I know of no evidence to support that. But one weakness of Telegram and the like is that you cannot authenticate who you are talking to in cyberspace. It would be like the 1-time pad distribution. You would have to use physical, non-digital means to deliver those pads/authentication codes.
Sure, internally Telegram might say it offers IP masking, but traffic analysis over a long time-frame can still be applied. I wouldn't trust it.