Manual targeted identification is possible even if you use public WiFi + VPN + Tor with 100 nodes. It's just a matter of user behavior analysis. Same goes with anything digital nowadays. You're either protected only from automatic spyware (Google, Meta etc) or not protected at all. At least some entity you're interacting with (whether it's a website, a person, a company or whatever else) is going to have some sort of tracking to it unless there are no network devices and physical surveillance agents in the area. Finding someone isn't hard. It sometimes can require irl interrogation though. At least that's what I know. Even if something I said isn't true, digital cryptocurrency transactions are still a little bit better than using a credit card (maybe unless you buy a fake entity but that's still breakable). I don't know any better alternatives (cash doesn't count because it's not digital)