Just an example... Also if you're broke just say so. (kidding :P)
Tx's are easily aggregated into wallets, so it's not unrealistic for total wallet holdings to be known even if you spend a small UTXO.
Lightning tx's can be linked to the UTXO used to open the channel. Network surveillance, traffic/amount correlations, and data from the large liquidity providers (Who are CEXs like Binance or other doxxed entities that must comply with blockchain Intel companies).
But for fun let's say specific methods are unknown or unclear. In 2020 IRS paid out $500,000+ to two blockchain surveillance firms to work on tracing (breaking the privacy) of Bitcoin layer 2s - Lightning in specific. So at least realize that highly capable adverseries that receive hefty amounts of gov. funding have been working on these attacks for some time.
