Why You Can't Call the Police

The talk follows an investigator at a law firm who was asked to recover NFTs stolen from a client who had hardened his accounts and said he had clicked nothing suspicious. The first step was reading the blockchain. The assets moved through a chain of burner wallets, were sold on an NFT marketplace, and the proceeds were spread across more wallets before being cashed out at a centralised exchange. Raw ledger data is hard to read without tooling, and a wallet address alone means nothing a court can use.

The team then considered whether a malicious smart contract could have moved the assets without the owner noticing. The talk covers fake minting platforms, functions with misleading names, and how common transfer methods are called once a user approves a request. Open-source searches tied one wallet to a domain name listed in a social media bio. Historical DNS records, a clinic website, family links, and an archived social profile then led to a named suspect, whose details were passed to the law firm for verification.

The second half covers evidence handling. Court exhibits must be printable, so screenshots need page numbers, URLs, and capture times, and a documented chain of custody shows who collected and handled each item. Metadata such as GPS data can matter for location-sensitive cases. A campaign collected about nine terabytes over three months, and live streams had to be captured chunk by chunk and converted. AI helped anonymise data before it went to outside tools. The takeaway is that blockchain activity is traceable, but linking it to a person is slow, and police often lack capacity for crypto cases, so user awareness remains the main defence.