Sending money to the address wouldn't out him like that. But there are a million tiny ways an unsophisticated kidnapper could mess up. For example, he doesn't know that whichever Bitcoin light client he used to generate a fresh address also pinged a server to fetch the balance. The FBI is probably asking every block explorer and light wallet owner about pings to that wallet pre-kidnapping. Or the hundreds of other tiny vectors you could make a mistake on (having your phone on you when casing the place weeks before and the FBI going over every phone, checking the wallet address on Mempool to see if you got the money), just too many LE resources combing over every possible angle. You can get away with small crimes, but when you're the the #1 target of the FBI, you better leave the country. If he's still in the US, there's no way out.(FatMan)