There are well known attacks to WPA by capturing handshake and running offline hashcracking against it. Also there are tools to exploit vulnerability in WPS to get the PIN. My question is why WPS handshake (if it is called handshake) cannot be captured and the PIN revealed. It seems impossible otherwise obviously someone had done it already.
A Diffie-Hellman key exchange occurs before exchanging the sensitive information. Please see https://www.grc.com/sn/sn-338.htm . The relevant part:
"But it absolutely will encrypt the dialogue so that somebody just capturing the packet traffic is unable to, as I said last week, get the data, take it home, and crack the PIN offline. That can't happen because the dialogue is protected by this initial establishment of a secret key which doesn't authenticate, but it does give them privacy."
So cracking the 'handshake' as you call it (it isn't really a handshake), would be much much more complex than just performing a brute-force attack against the PIN, as this 'handshake' is encrypted with strong asymmetric encryption.