The precise claim is not that Taproot makes the initial theft of BTC easier. Theft still requires compromised keys, fraud, coercion, a custodial breach or some other failure of control.

What Taproot makes easier is concealing what happens afterwards.

Before Taproot, different forms of spending often left different on-chain fingerprints. A conventional signature, a multisignature arrangement and a complex script could frequently be distinguished by examining the transaction structure. Taproot deliberately reduces those distinctions. A key-path spend can make an ordinary payment, a cooperative multisignature spend and the settlement of a more complicated contract appear substantially alike. If a script path is used, only the executed branch must be revealed rather than the entire set of possible conditions. That privacy improvement is not an accidental side effect; it is stated explicitly in BIP 341.

Schnorr signatures extend the effect. Multiple parties may cooperate to produce what appears on-chain to be a single ordinary signature. MuSig2 outputs controlled by several signers can therefore be indistinguishable from single-signer Taproot outputs. Adaptor-signature constructions may also hide contractual relationships and reblind secrets between payment hops, making linked operations resemble unrelated ordinary transactions.

This does not mean Taproot itself is a mixer. CoinJoin existed before Taproot. CoinJoin combines the inputs and outputs of several users so that the public ledger no longer provides an obvious one-to-one mapping between payer and recipient. It disrupts the ordinary heuristics used to follow ownership across transactions. Modern research still identifies many CoinJoin structures and sometimes reduces their effective anonymity sets, but attribution after mixing remains substantially more difficult than following an ordinary transparent payment.

Taproot makes the surrounding environment more accommodating to concealment because complex arrangements can be made to resemble ordinary spends. The forensic analyst sees less structure, fewer disclosed conditions and fewer obvious distinctions between individual control, collective control and contractual settlement.

Lightning then moves much of the relevant activity away from the public blockchain entirely.

The base chain records the funding and eventual closing of a channel. It does not contain a complete public ledger of every intermediate Lightning payment made while that channel remains open. Lightning uses onion routing so that an intermediate node normally learns only where a payment came from immediately and where it must go next. It does not receive the complete route, and the packet is altered at each hop. The specification nevertheless acknowledges that traffic analysis may still associate activity.

This creates an obvious attraction for anyone attempting to obscure the movement of stolen funds. Coins may enter Lightning through one channel, move through several privately routed transfers, be exchanged against other channel liquidity, and later leave through a different channel or service. The blockchain records the outer transactions, but not a complete public chain of every internal transfer connecting them.

That is not the same as saying there is “no record”.

Lightning nodes may retain local records. Custodians and exchanges may possess customer information. Channel topology, timing, amounts, network surveillance and operational mistakes may reveal relationships. Academic work has demonstrated cross-layer techniques capable of linking Lightning nodes to Bitcoin addresses and inferring information about balances, senders and recipients. Lightning privacy is consequently meaningful, but neither absolute nor guaranteed.

The accurate conclusion is therefore more serious than the exaggerated one.