you know that’s a really great point. I had assumed they would make sure he didn’t have a credit card or monitor it etc but you can buy whatever amount of VPS or dedi storage you want with crypto. I’m sure he had knowledge of DNS exfiltration etc to get past any Wi-Fi blocks, or just crack the password for any nearby hotspots if he wasn’t allowed internet access per his detainment.
My thought was he probably gave the initial foothold info to other lapsus members and they took it from there but you’re right he absolutely could have.