In the case of a criminal investigation, how does one knows which exchange or wallet service a bitcoin address belongs to? How it was found that the Dao hackers used shapeshift?

In a more practical exemple, how to find that 13qCK9VzJCicXeh47W59rh7A6tfun92Sr5 belongs to https://www.blockchain.com using only block explorer data?
There is no guaranteed way to check.

In most investigations, it is a combination of tracing the money to known addresses (most exchanges and companies consolidate funds into a handful of hot and cold wallets), and exchanges volunteering/sharing information when served with warrants.