Blockchain on the Stand: Crypto Investigations In & Out of Government | Boston Blockchain Week 2026

You guys are hardcore for still being here. We're so glad that you are. Please feel free to interrupt at any time with questions. I'll keep an eye out for hands, but would be totally happy to make this a discussion, especially that we're such a smaller crowd right now. So, my name's Georgie McDonald.

I'm a partner at Nexo. I was a federal prosecutor in the District of New Hampshire for 10 years before joining Nexo. And I had the fortunate experience of getting to work on some crypto cases early on as the live free or die state and home of the free state movement. There was a lot of early crypto adoption in New Hampshire and with that brought some interesting cases. One of my first crypto trials was attended by Mr.

Bitcoin, a guy in a giant Bitcoin costume who would literally get stuck in the revolving doors when he was trying to enter the courthouse. And unlike what some of my defendants would say, prosecuting crypto-related crime did not mean I was out to destroy crypto as my crypto crime-fighting team here will tell you, we did the work because we were interested in digital assets and thought they were cool, right? Pete is a agent who spent his career fighting crypto crime and he also mines Bitcoin. So, all of us are now outside the government. for Nexo Labs where we continue to do cyber and crypto investigations.

We still do them for the government. We're expert witnesses in a crypto Ponzi scheme, but we also do them do the work for criminal defendants. We testified for Roman Storms' attorneys in the Tornado Cash trial. And we also do investigations for civil litigants. We trace crypto for we trace DPRK stolen crypto for victims of terrorism who have money judgments against North Korea.

We file expert reports in support of lawsuits against allegedly fraudulent tokens by investors. And we do on a pro bono basis tracing for victims of frauds and scams. So, we know this is mostly industry folks in the room. So, we will we want this to be sort of a practical. I won't talk a lot about legal stuff here today, but I will talk about how if you're a company in the crypto ecosystem and you are touched by the legal system in some way, you are a custodian of records and you have to testify in court or you've been the victim of a theft or a hack.

And you're going to court or thinking of calling the the FBI, you are you know, otherwise somebody who is a custodian funds that have been seized. Or hopefully not, but you're the target of an investigation. What are some practical steps? What does that really mean? And what should what should you do?

So, let me start by having my colleagues here give brief backgrounds. Laura, I'll start with you.

Sure.

So, hi everyone. My name is Laura Tangbua. It's nice to be here with you all. And yes, kudos to everyone for being here still at 5:00 p.m.

or just about. My background is a little bit different than a lot of the crypto experts at Naxo. I started my career as an intelligence research specialist, also known as an intelligence analyst with the Drug Enforcement Administration. I spent about 14 years with the DEA and I feel like I was just super fortunate with my assignments to start in San Francisco. Then I went over to Quantico and I taught on a domestic and international basis for all types of OSINT collection and intelligence collection.

And ultimately, I wrapped up my time with DEA at the Portsmouth Tactical Diversion Squad right in Portsmouth, New Hampshire. It was really at the TDS, um, the Tactical Diversion Squad, that I really started to see the cryptocurrency come in a lot of our drug investigations. Um, it was with the dark web marketplaces, it was diverted chemicals, and um, it was just fascinating for me to start to see in a lot of ways that replaced the payments that we were typically seeing, like the bulk cash go up and down the 95 corridor. So, it was a big shift. Um, after DEA, I spent about 5 years, um, doing corporate strategy and supply chain intelligence, and I joined Nexo about 3 months ago, where I'm primarily focused on our open-source intelligence collection and research investigations, um, and helping Pete build our sensitive information detection and response service, which we, uh, call SIDAR.

Thanks, Laura. Uh, I will say I haven't mined a single block yet. I just use it to heat my office in the winter, so I just want to make that clear. Um, I'm Pete Manning. Um, I started my career with the Secret Service, uh, spent about 8 years, um, split my time between the Electronic Crimes Special Agent Program and, um, foreign dignitary protection.

Um, if this dates me a little bit, my first ransomware case was in 2003, so back when, like, floppies were around. Um, I transferred over to Homeland Security Investigations, um, about 15 years ago, where I spent most of my time investigating, uh, decentralized networks, um, so, basically, Tor, where, uh, dark web marketplaces live, uh, where almost any type of crime is, um, and that includes marketplaces that use cryptocurrency to, um, buy and sell whatever you want. And, uh, I've been at Nexo for about 2 years.

Awesome. So, we live every day but can be hard to understand if you are somebody who is, and hopefully you're not, in the courtroom all the time, is that there's a really big difference between knowing that something happened and proving it in court. And so, before we talk about the mechanics of a blockchain case and introducing blockchain evidence, I want to ask you guys about sort of that underlying concept, which I think really informs how you conduct your investing. So, Laura, can you talk a little bit about that?

Sure. Yeah, I definitely this is something I'm actually super passionate about and we would teach all of our basic intelligence students and special agents going through the academy at Quantico. As was I taught day one or at the first week of the academy that we need to always plan ahead for court on day one of an investigation. So, that meant throughout the investigation we were always preserving evidence, we were documenting all of our evidence, and we always kept that chain of custody in mind. Always front and center.

Um, like I said, we taught this day one at Quantico for our intel students and we would reiterate that. And a good reason behind that is because when we're building our investigations, that piece of information we may get on day one, that may not come up until court a few years later. And for us that was just of utmost importance to make sure that we were always documenting and preserving. And as many of you I'm sure are aware, federal investigations can start from one small piece of information and go into huge drug trafficking organizations for what I was looking at and helping our team with. And that being said, we just had to really make sure that if any of the that information that we gathered spun off into a different investigation, we did our due diligence in the beginning, so we weren't ever passing that like fruit of the poisonous tree to another agency or a local police department or whomever we were working with.

Um one quick example of that would be if I was working with an agent like Pete and we were with a confidential informant or cooperator and they might say show us something quickly on their phone, whether it's a crypto payment or whether it was a text message or something on Snapchat, whatever it was. Um we couldn't just say great, write the information down and just go run with it. We had to make sure we preserved it. So whether that meant that informant sending us a screenshot of what was on his or her phone or Pete or I taking a picture of that phone and then documenting the date, the time when we saw it, write it in our notes, um and furthermore going to make sure so when we would to court with an AUSA like Georgie, we would be able to say not only do we have this information, but we took the next step to send a subpoena or we took the next step to preserve the text message content or whatever it may be.

Or what about this, Laura? If you say you um you know, somebody has a friend at a um a you know, a software company or a wallet company in another country or an exchange in another country and they call them up and say, "Hey, I traced some crypto. It seems like it might be related and your friend shows you the records and even you screenshot them." Right? That means nothing in court unless that company is going to also comply with legal process and send you the records formally.

So you can see it and know that it's there, but can you enter those records in court is a whole other question, right?

Absolutely and I personally would never want to be someone that would get on the stand and not actually have evidence or something to prove or back up what I was saying, nor would I ever want to get on the stand and have a defense attorney or anyone else say to me, well, what date did you get that information? And I would be like, maybe September 2026. Like, we need to know the date, the time, the scenario, the origin, and then have it backed up. So, as mentioned, a lot of our investigations weren't just a week or two long. Some of our investigations right now at Naxo aren't a week or two long.

They're ongoing investigations. So, we always look at it with that eye of preservation, no matter what type of cyber investigation we're looking at.

Okay, so knowing that how sort of buttoned up you need to be to introduce evidence in court, I want to turn to you, Pete, and ask, so you know, you have a case where you have traced crypto, you funds were stolen, and you've traced them to a wallet that you think is interesting. How do you start like an investigation into that? Where do you Where do you go from there?

Yeah, I think it's very tempting to just start tracing almost blindly. I do this, too. Get like a tunnel vision, but it's really helpful to step back and take all the pieces of the case into account. So, that means try to get in the mindset of the threat actor. What are they trying to do with the funds?

How are they supposed to evade law enforcement forever? And just think about the processes they use to go through the scam or whatever it is they're doing. But most cases start out with a, you know, a very low-hanging fruit approach, which could be as simple as Googling an address to see if it's been attributed to somebody, a threat actor, or an exchange. I mean, we've all been on block explorers where they'll label wallets as being from Coinbase or from Bybit or something else. So, those are literally the first steps.

And if you get lucky, Um, that address comes back to an exchange. Um, you can start helping your, um, investigative team put together court process where you would request records, KYC records from that exchange, and that's going to be really some of your best evidence. Because everybody who's using a centralized exchange has to use their identity and information, and it has address history and payments and transactions, um, deposits into that account, and that stuff is really, really important in court because, like Laura was saying, um, you will have a keeper of the records that will actually present these in an official way, and you can enter those into, um, at trial. Where it gets more tricky Someone's coming behind me. Um, where it gets more tricky is if you come across a self-hosted wallet, a decentralized exchange, and that's where you have to start looking at, uh, co-spending, um, or first funding of different wallets.

And really what that means is you have to start looking, again, at the big picture and hoping that you have more evidence that you can start putting together because, yeah, I mean, most, um, blockchains are pseudonymous, not anonymous. Um, so there are aspects of the case that you can actually start putting together and wrapping up for court.

Right. Blockchain evidence alone is never going to get you where you need to go. So, Laura, you're the OSINT expert here. Can you talk a little bit about how you, um, investigate who's behind the address?

Sure. So, in a lot of our investigations, you know, we've found that the blockchain, the data, that's only going to really matter as much as we can actually look and try to prove the person that's actually controlling the address itself. So, um, a key point here is when we're looking to see when that crypto actually touches something regulated, whether it is an exchange or whether it is a cash-out point, that is something that we really try to hone in on. Um, Um now, government authority subpoena authority was actually much much easier to get a return. Um that's actually been one of the hardest things for me going into the private sector.

I was just so used to when we when I was an analyst with DEA, we could send subpoenas and sometimes get them back the next day or week. It's a much different process now um when we're at Naxo. However, we've all been seeing that a lot of the law firms that we work with on a day-to-day basis and other law firms in general, they're more willing to serve um the legal motions to a lot of the international exchanges and that's been super helpful for us to get a lot of that customer data back to help in our investigations. Uh that being said, if we aren't able to send that subpoena or whatever legal motion it is, um I'm a huge fan of OSINT. Obviously, that's something I do.

And even if we have a piece of information from uh a law firm or a cooperator or any part of the investigation, that a lot of the time Pete and I will take it could be a social handle, it could just be a name, anything we can get, we can start our OSINT side of the investigation, often working in parallel with a lot of um the tracers at our company. Uh and really, I always like to say that OSINT, and I know a lot of people have probably heard the same thing, it's truly like getting sprayed or drinking from a fire hydrant, I guess you could say. There is just so much information out there that can help you in your investigation and even from when I started in DEA in 2007, um dating myself a little, but not 2003. Um I was We would look at OSINT and publicly available information as helpful in our investigations, but throughout 2010 and going into 20 and now 2026, there has just been this evolution of OSINT with social media presence and everyone loving to put everything about themselves out on the internet. Um, things like Reddit, platforms like LinkedIn for professional network.

I mean, that is an amazing source of information for us at times when we're looking at our investigations. So, definitely in general, OSINT just is such a wealth of information in our investigations, whether yes, we get a subpoena return from an international exchange, or maybe no, we don't. Um, I would just highly encourage anyone that's not already looking at OSINT, um, if you are looking at any type of investigations, um, to take a serious look at the information that you can find out there. Um, now, one last final thing is almost there's too much out there where Pete and I spend maybe quite a few hours just filtering through the noise, um, trying to grab that signal, that actual piece of information that's going to move the needle in our investigations. Um, you know, certain federal agencies, many federal agencies have their own OSINT units where they're just looking at publicly available information.

Um, so I think it just goes to show what's out there. Uh, again, it's just really trying to filter through that noise to get the actual information that's going to help your investigation.

Great. So, let's say you've gotten lucky, we got exchange records on a case, or uh, Laura did some like incredible Telegram work in the middle of the night and found the screenshot somebody posted of their address. Like, you've charged a case, you've brought a lawsuit. How do you present blockchain evidence in court? How do you show it to a judge?

How do you get it admitted?

Yeah, it's tough. It's like anything that's a new technology, it's hard to explain it to somebody who doesn't do it every day. Um I mean, I think you start with the basics. There's a lot of analogies out there that people use that can really bring like that real life feel to crypto. Um Some of the toughest things is trying to explain how you can put somebody behind the keyboard when they're actually, you know, this is supposed to be blockchain evidence.

And you know, when you talk about things like seed phrases that could be passed on a slip of paper. Um the difficulty of when crypto actually changes hands and and some of those really intricate things can be very tough to explain. Um

Yeah, how do you explain the difference between somebody is sending their crypto to someone else and they're sending it through a bunch of self-hosted addresses to launder money. How do you explain that to a judge that, you know, only understands dollars?

Yeah, I mean, you find an analogy that works. Like if you want to use bank accounts or you know, any types of transactions that people that normal I say normal people, non-crypto people do on a daily basis, it's easier to explain how blockchain works. And you can, you know, talk about ledgers and like just being making sure that every transaction is the, you know, unique transaction. Um you can get there. Um And yeah.

And um when you are presenting that um testimony, you know, one thing I wanted to talk a little bit about is that we're often presenting it as expert testimony, right? And what is that What is expert testimony generally and

Yeah, so you have to be qualified as an expert. Um and that means that you're an expert in your field and that mean if you haven't testified before, it means you probably have to face somebody like Georgie who's going to actually grill you. I don't know if you want to talk about how presenting an expert in court and vetting them actually works.

Yeah, and you know, whether this is right or wrong, and I think it's probably wrong, most of blockchain evidence that's introduced in court today is introduced as expert testimony. And what that really means is that a judge gets to be a gatekeeper about who can present the evidence and how it can come in. So, a judge has to decide this person is qualified but based on their training and experience and education to talk about it and they've used reliable scientific methods. Now, like typically that's like a doctor or a scientist, and that's easier to explain than um in crypto where there isn't like a clear path to getting your certification necessarily. And um there aren't scientific methods that have been peer-reviewed, and it's kind of hard to explain to a judge that like white papers and GitHub repositories should be considered the same as like medical journals when determining whether clustering is an appropriate heuristic for expert testimony.

So, um that's a just an extra hurdle that you have to take in these cases, and it happens all the time, and this evidence is introduced all the time, but you have to sort of take that extra tricky step that you may not have to take in presenting other types of evidence. So, given that and given the challenges, Pete, like take or leave blockchain evidence. Would do you want to find have it in your cases?

I mean, obviously take it. Um I think one thing that kind of puts everything in perspective, too, is you talk about clustering. Um one thing that's important is that the the reliance on software tools, there's a lot of industry standard tools out there. Um we always use a variety of different tools, but always go back to the source of truth when it comes to a block explorer, actually going back to the actual original transactions, but um I think even with all the challenges that crypto brings, it's still a um a verifiable ledger of what actually happened, including what happened in your crime. And it's how rare is that to bring evidence that is so final?

Um it's up to us as the investigators to present it to judges and juries and attorneys to be able to explain why we think this individual person or why this company is the either victim or the threat actor behind it. Um so I I definitely think you have to take it.

Um do you have an example of a case where that um you know, blockchain evidence has been particularly useful or um probative?

Yeah, so fairly recently we helped Google with a case. It's a phishing-as-a-service case. Um this was um you know, everybody gets those uh you haven't paid your Easy Pass text messages and you have a weird link at the end of them. You got to click it and make a payment. Um those are all generated by uh most of them are generated by literally software that sits on servers that people use as like a a service.

And they generate tens of thousands of different uh phishing pages a day. Um to get a license for those servers, you make a [clears throat] crypto payment. And so one of the things we found out through like the work that Laura does is being able to um figure out that somebody has to pay make a payment. And if they want it for a week or a month or a year, they make a specific amount payment. And you know, for this it was done on um it was USDT on Tron.

But you had to pay $88 a month. Um and with that payment, you got that license. And so once we had a few addresses, we were able to see exactly how many payments were made, how many licenses were purchased, how many threat actors we were dealing with because they didn't think to change addresses that often. And we could see the payments very clearly about hey, these are $88 every time.

Yeah.

And so that's a like a very simple way of like crypto-enabled crime coming with fraud um that we're able to put that simple piece of evidence together.

And that was like the easiest thing to make, right? You You found an address, you're able to see in 2 seconds, "Oh, I can make this beautiful chart of every criminal that bought this service over the last 2 years." And that's really compelling, and you can prove it's an immutable record, and it's all It's all there, and it's not going to change.

Yeah, and if you had to do that in court, it's very presentable. Like, you That's something a jury could understand, right? Like, people get those text messages, and when you say that that software comes from something a payment that's made on a blockchain, they can start putting those pieces together of how that works.

So, we have a couple minutes left. I I think I sort of a wrap-up topic. I I guess what I would ask is, you know, if folks in the room, I think we have a lot of technical folks in the room, if they were to you know, touch the legal system. For example, they their company was hacked, or they're a victim of a theft. Like, what's advice that you have on what they should do, when to reach out to law enforcement.

What's some some practical tips you might have?

Yeah, I'll caveat this by saying an incident response person, so I'm not the one that's going to go out and be on scene, but I I think you need to really circle the wagons and figure out, are you still under attack? Like, is the whatever's happening still happening? Um and you really need to dig deep in that. Um I think after that, you really need to start preserving records, and that means air-gapping whatever you find, putting on thumb drives, or just off your network. So, think of these as things that you're going to have to give to somebody as proof that you've been hacked, or you You've had your funds stolen, or whatever it is.

Um make sure you preserve those in a safe way. And I think the bigger question is is when do you call law enforcement? And um I'm conflicted here because a couple of years ago, when I was in the government, I would have suggested maybe the call would come to us first, but now being outside um you could go either way. I mean I think there's a very a strong benefit to getting all your ducks in a row before making that call. Um one you know what's happened, you know what you have, and you better you can better explain it.

Um and uh it doesn't you know as as scary as calling the government is, it doesn't mean that you're going to have to open up your doors and your all your servers to everything. Um you're just reporting being a victim of a crime.

Okay. Um I think that's all all the questions I have. We have like 2 minutes left. Is there anybody in the room who has a question for the team? Yeah.

Uh all the time. I mean so that's that's really the tricky part. We can trace stuff all around the world and then a lot of times it'll end up on an exchange that is in unfriendly territory and we have very little you know recourse. Um but we still know where it is. I mean so you talk about threat actors that are working out of North Korea, you're not going to be able to go in and seize funds out of North Korea.

But we can see all the scams that they have been running and all the different hacks and stuff going through their addresses and just keep those networks under observation and just provide those as you know as they as they come up.

And I think internationally exchanges have been getting more willing to provide records quickly or to respond and are more perhaps like subject to the pressure you know reputational pressures as well. So, there's you know, it's not always hopeless, but

Yeah, I mean

But it's hard. But it's and it's always overseas for sure, quickly.

And the one thing maybe we glossed over a little bit is but the government, you know, they are the best to be able to freeze funds, assets quickly and even in an international exchanges. So, we're on the private side we don't have that power, but making that call to law enforcement, they can reach out to international exchanges and get funds frozen very quickly.

Yeah.

I have a question. So, for example, you have person A $5 million towards the bank for some criminal activities and he sends money to a software studio flash drive that contains that money. And then he uses the GitHub repository to share it with someone else. And then eventually the person B who receives that key to the non-custodial flash drive wants to get that money out. Will you still see for example where he gets that money from person A to a location C after that person withdrew the money from the GitHub repository?

How can you track all that and what's the point of using the GitHub if you can still eventually see if the initial sender and the final sender?

Yeah, I mean I think you're getting to the root of the problem or the the difficulties with crypto investigations is like who has actual control of that wallet. I mean, I assume when you say GitHub repositories, talking about actually sharing keys. Somebody else has the keys to that wallet and they can make transactions as well. And so, that's the hard part, right? You really need other pieces of evidence to block that up.

I mean, you're going to have to have Telegram activity, IP addresses, something that comes back to that transaction that just isn't like literally a transaction hash, a value, and a date and time. Um, that's like Georgie said, that's never going to be enough to actually convict someone in a court of law. You need more to be able to put that story together. It's all it is is just a a ledger um entry and numbers. So, you really need to have extra.

That answer your question? I I think I kind of understand what you're asking. Yeah.

Well, thank you all so much.

Thank you.