First, know that all Bitcoin transactions and wallets are, essentially, public. All this information is stored in the blockchain. By constantly updating your copy of the blockchain, you are up-to-date with each wallet's balance. So you'd know where the money is, right ?

In the crypto world, we have something called a vanity address that is, basically, a personalized wallet address. By understanding the way the private-public key pair is generated, you can generate an address that starts with a chosen combination of characters.

At this point, you can choose the address of a non-empty wallet, take the first characters of this address and proceed with the vanity address generation algorithm, hoping that the final result will be same address, together with the private key. Even though it clearly improves your chances, this alone won't really do the trick, it won't get you an used address unless you are impossibly lucky or have a lot of time to wait (read "eons").
Here comes in the understanding of the ECDSA algorithm, the underlying equation (which is rather simple, form-wise) and the fact that you work with (or in) a prime field. Graphically, the equation won't really make sense to people used to working with real numbers, but those points aren't random (obviously). The coordinates of those points play an essential role in helping us get closer to a desired output. Randomness is still here, since the number of possibilities is enormous and we do approximations starting from a random seed, but not so random as it would have been as going blind, thus increasing our chances considerably.

All this wouldn't be possible without strong knowledge about the sha256 and ripemd160 hashing algorithms, since, at each step, we need the results from this functions and performing them in their original form would be exhausting process-wise.
As a "too long, didn't read" version, by using a (rather large) set of optimizations and micro-optimizations, we increased the chances of randomly finding an used address by many orders of magnitude. Even so, finding one is still a very long shot, but definitely way better than going random for one of the gazillions of addresses possible.

Luck still plays a huge role here and we are not the luckiest people around, so we're putting this out in the open, hoping that it will be the lucky push an already lucky person needs.
Get lucky
When you get rich, if you feel like buying us a beer, here's our address:
Cheers !