Registrations
SAVA CENTAR, BELGRADE
Main track
09:00 - 10:00
Registrations
Bjorn Clevers
10:00 - 10:10
Welcome and opening remarks
Bjorn Clevers
10:10 - 10:55
Keynote speech
Sungyong Kang
Intelligence and Investigation on Crimes Abusing VAs — Possibilities and Limitations, Learning from Practices
This presentation will illustrate the current hurdles encountered by LEAs in investigating crimes abusing virtual assets throughout detection, tracing, intercepting, recovery, management of recovered VA, and prevention — and what the law ought to be.
10:55 - 11:25
Presentation (1)
Fred G.
Agentic Investigators. Human Judgment.
How AI agents and humans work together at OpenAI to disrupt emerging harms.
11:25 - 11:55
Coffee break
Bjorn Clevers
11:55 - 12:25
Presentation (2)
Nenad Bogunović
Inside the Case: How We Stopped a Ransomware Group That Hit the Entire Balkans
Sixteen ransomware attacks across the Balkans, one group behind them — the first national presentation of a case previously shared only at The Hague. How attacks in different countries were linked, how internal telemetry and OSINT led to attribution, and what lessons SOC teams and investigators can take away.
12:25 - 13:15
Panel discussion (1)
Vladimir Petrović
From Alert to Attribution: Where the SOC Meets OSINT
A SOC sees what happens inside the network, while OSINT reveals what is happening outside it. Real cases, practical workflows, and how AI-generated threats are changing the game for defenders and investigators.
13:15 - 14:00
Lunch break
Vladimir Petrović
14:00 - 14:30
Presentation (2)
Vladimir Petrović
UserSearch
Content pending from sponsor.
14:30 - 15:00
Presentation (3)
Milivoj Rajić
Inside the Dark Web: What Criminals Share and Why Threat Intelligence Matters
Every day, cybercriminals on dark web forums and closed messaging channels sell access to company networks, stolen passwords, leaked databases and target lists — often for a few hundred dollars. Real examples from 2025–2026 show what is shared, what it costs, and how dark web monitoring turns traces into early warnings..
15:00 - 15:30
Coffee break
Vladimir Petrović
15:30 - 16:15
Panel discussion (4)
Vladimir Petrović
Ransomware, Initial Access, and Crypto Cash-Out: Connecting the Entire Attack Chain
Suggested angles:
- Initial access brokers
- Negotiation and extortion infrastructure
- Tracing ransom payments
- Seizure, disruption, and recovery opportunities
- Intelligence fusion across cyber and financial investigations
16:15 - 16:45
Panel discussion (4)
Milena Nikolić
Siemens
Content pending from sponsor.
16:35 - 16:40
Closing remarks
Bjorn Clevers
SAVA CENTAR, BELGRADE
Blockchain Forensics Forum
09:00 - 10:00
Registrations
Ivan Bjelajac
10:00 - 10:10
Welcome and opening remarks
Vladimir Petrović
10:10 - 10:40
Presentation (1)
Barry Walsh
Cybercrime Investigation and Digital Forensic Examination in Ireland
How are cybercrime cases investigated and prosecuted in Ireland? Digital evidence acquisition, forensic examination methods, and cooperation with international partners — encryption, cloud data and cross-border jurisdiction.
10:40 - 11:25
Panel discussion (2)
Vladimir Petrović
Policy, Intelligence, Prosecution: The Chain of Crypto Enforcement
International policy, financial intelligence and criminal prosecution perspectives on how virtual asset cases are built — AML/CFT frameworks, OSINT-driven tracing, public-private cooperation and cross-border evidence.
11:25 - 11:50
Coffee break
Vladimir Petrović
12:45 - 13:15
Presentation (2)
Vladimir Petrović
Cracking the Drainer: A Real-World Investigation Combining Blockchain Analytics, Smart Contracts and Digital Intelligence
How strong data governance underpins successful cryptocurrency investigations — managing, verifying and stewarding massive datasets, retention policies, standardization, data sharing frameworks and cross-jurisdictional cooperation.
13:15 - 13:55
Panel discussion (2)
Vladimir Petrović
13:55 - 14:00
Closing remarks
Vladimir Petrović
14:00 - 14:45
Lunch break
Vladimir Petrović
SAR/STR Masterclass — Write Compliant Reports for U.S. & EU FIUs
Detailed information about the SAR/STR Masterclass Workshop can be found here.
14:00 - 15:15
Part 1
Vladimir Petrović
SAR/STR Masterclass — Write Compliant Reports for U.S. & EU FIUs
Expert: Erin O'Loughlin, Senior Director of Training at Association of Certified Financial Crime Specialists
15:15 - 15:35
Coffee Break
Vladimir Petrović
15:35 - 17:00
Part 2
Vladimir Petrović
SAR/STR Masterclass — Write Compliant Reports for U.S. & EU FIUs
Expert: Erin O'Loughlin, Senior Director of Training at Association of Certified Financial Crime Specialists
Ransomware Investigation
Detailed information about the Ransomware Investigation Workshop can be found here.
14:00 - 15:15
Part 1
Vladimir Petrović
Ransomware Investigation
Expert: Larry Cameron, CEO at Paradigm Intelligence
15:15 - 15:35
Coffee Break
Vladimir Petrović
15:35 - 17:00
Part 2
Vladimir Petrović
Ransomware Investigation
Expert: Larry Cameron, CEO at Paradigm Intelligence
Sava Centar, Belgrade
09:00 - 10:00
10:00 - 10:10
Welcome and opening remarks
10:10 - 10:55
Keynote speech
Intelligence and Investigation on Crimes Abusing VAs — Possibilities and Limitations, Learning from Practices
Speaker: Sungyong Kang, Criminal Intelligence Officer at INTERPOL
This presentation will illustrate the current hurdles encountered by LEAs in investigating the crimes abusing virtual assets throughout the different phases of investigation: detection, tracing, intercepting, recovery, management of recovered VA, and prevention. At the same time, this presentation will describe the operational activities of INTERPOL to overcome the hurdles under the current legal context and suggest what the law ought to be.
10:55 - 11:25
Presentation (1)
Agentic Investigators. Human Judgment.
Speaker: Fred G., Head of Technical Threat Investigations at OpenAI
How AI agents and humans work together at OpenAI to disrupt emerging harms.
11:25 - 11:55
Coffee break
11:55 - 12:25
Presentation (2)
Inside the Case: How We Stopped a Ransomware Group That Hit the Entire Balkans
Speaker: Nenad Bogunović, Deputy Head, Service for Combating Cybercrime, Ministry of Interior, Republic of Serbia
Sixteen ransomware attacks across the Balkans, one group behind them. This is the first national presentation of a case previously shared only at The Hague. Through the real investigation, we will show how attacks in different countries were linked, how internal telemetry and open-source intelligence together led to attribution, and what lessons SOC teams, investigators, and organizations in the region can take away.
12:25 - 13:15
Panel discussion (1)
From Alert to Attribution: Where the SOC Meets OSINT
Moderator: TBA
Panelists:
- Vladimir Petrović, Team Leader for Cybersecurity & SOC at Unicom Telecom
- Nathan Rosero, Head of Client Relations at OSINT Industries
A SOC sees what happens inside the network, while OSINT reveals what is happening outside it. This panel explores how combining internal telemetry with open-source intelligence leads to faster triage, stronger investigations, and more defensible evidence. Expect real cases, practical workflows, and a look at how AI-generated threats are changing the game for both defenders and investigators.
13:15 - 14:00
Lunch break
14:00 - 14:30
Presentation (3)
The Digital Investigator’s Toolbox: A Master Investigator’s Playbook and Tools
Speaker: Mark Bentley, Subject Matter Expert at UserSearch
Modern investigations are won or lost in the digital layer, where every device, account, and click leaves a trace for those who know how to find it. In this session, a seasoned practitioner opens up their playbook, showing how to build a repeatable, defensible workflow from the first lead to the final report, using the best and most reliable free and paid OSINT tools available.
14:30 - 15:00
Presentation (4)
Inside the Dark Web: What Criminals Share and Why Threat Intelligence Matters
Speaker: Milivoj Rajić, Cyber Threat Intelligence Lead at DynaRisk
Every day, cybercriminals on dark web forums and closed messaging channels sell access to company networks, stolen passwords, leaked databases and target lists, often for a few hundred dollars.
This talk takes the audience inside that world. Using real examples from underground forums and incidents from 2025 and 2026, including a ransomware group’s leaked chats, a data exposure at a major European fintech and a mass leak of firewall credentials, we will show what is shared, what it costs and how attackers use it. Because these traces appear long before an attack, dark web monitoring and threat intelligence can turn them into early warnings.
This talk takes the audience inside that world. Using real examples from underground forums and incidents from 2025 and 2026, including a ransomware group’s leaked chats, a data exposure at a major European fintech and a mass leak of firewall credentials, we will show what is shared, what it costs and how attackers use it. Because these traces appear long before an attack, dark web monitoring and threat intelligence can turn them into early warnings.
15:00 - 15:30
Coffee break
15:30 - 16:00
Presentation (5)
The Man Who Faked His Death
Speaker: Nathan Rosero, Head of Client Relations at OSINT Industries
This presentation looks at the case of an FBI-wanted fugitive suspected of faking his own death and how OSINT can be used to trace his digital footprint and identify new leads. Through this case, I'll show how investigators can save time, reduce manual work, and handle complex investigations without having to deal with complicated tools.
16:00 - 16:30
Presentation (6)
Cybercrime Investigation and Digital Forensic Examination in Ireland
Speaker: Barry Walsh, Head of the Garda National Cyber Crime Bureau, Ireland National Police
How are cybercrime cases investigated and prosecuted in Ireland? This session walks through the investigative process from the first report to the courtroom, covering digital evidence acquisition, forensic examination methods, and cooperation with international partners. Attendees will gain practical insight into the challenges investigators face, from encryption and cloud data to cross-border jurisdiction, and what they mean for organizations that may need to support an investigation.
16:30 - 16:45
Closing remarks
09:00 - 10:00
Registrations
10:00 - 10:10
Welcome and opening remarks
10:10 - 10:40
Presentation (1)
TBA
Speaker: TBA
10:40 - 11:25
Panel discussion (1)
Policy, Intelligence, Prosecution: The Chain of Crypto Enforcement
Moderator: Aleksandra Djokic
Panelists:
- Katharina Ohnesorge, Office of the Public Prosecutor General in Bamberg, Bavarian Central Office for the Prosecution of Cybercrime
- Pamela A. Clegg, Head of Growth Strategy at Inca Digital
- Stanislava Milankov, Project Associate at OSCE
Illicit crypto flows cross borders faster than most legal systems can follow. This panel brings together perspectives from international policy, financial intelligence, and criminal prosecution to examine how virtual asset cases are actually built, from AML/CFT frameworks and OSINT-driven tracing to the courtroom. Panelists will discuss public-private cooperation, the challenges of cross-border evidence, and what investigators and compliance teams can do now to turn blockchain data into prosecutable cases.
11:25 - 11:50
Coffee break
12:45 - 13:15
Presentation (2)
Cracking the Drainer: A Real-World Investigation Combining Blockchain Analytics, Smart Contracts and Digital Intelligence
Speaker: Oleksandr Plakhotnyuk, Chief of Division for Combating Crimes Related to Virtual Assets, Cyberpolice Department of the National Police of Ukraine
This panel uncovers how strong data governance underpins successful cryptocurrency investigations—turning raw metadata into clear insights that trace illicit money flows. Experts will explore how to manage, verify, and steward massive datasets: ensuring integrity, respecting privacy and legal constraints, and enabling efficient linkage between on-chain activity and real-world entities. Discussions will include best practices for retention policies, standardization, data sharing frameworks, and cross-jurisdictional cooperation to empower law enforcement and regulators in fighting crypto-crime.
13:15 - 13:55
Panel discussion (2)
Follow the Stablecoin: Who Should Catch High-Risk Flows: the Chain, the Exchange, or the Analyst?
Moderator: Ivan Bjelajac
Panelists:
- Goran Safran
- TBA
Over five years, USDT on Tron’s share of identified high-risk inflows to centralized exchanges rose from 9.2% to 68%, while Bitcoin’s fell from 83.1% to 11%, according to Global Ledger’s High-Risk Benchmark. Sanctions-related activity accounted for the majority of identified high-risk inflows in 2025, while funds traveled through more intermediary transfers before reaching exchanges than in 2021. As the U.S. GENIUS Act and the EU’s MiCA framework reshape stablecoin and crypto-asset regulation, obligations increasingly apply to covered issuers and service providers. Yet effective risk management also requires examining transaction pathways and infrastructure choices upstream of exchange-level compliance controls.
This panel brings together two perspectives that rarely share a stage: one who measures risk across the industry’s largest exchanges, and one who has spent two decades building products.
This panel brings together two perspectives that rarely share a stage: one who measures risk across the industry’s largest exchanges, and one who has spent two decades building products.
13:55 - 14:00
Closing remarks
14:00 - 14:45
Lunch break
Workshops — parallel tracks
Two workshops run in parallel, each split into two parts.
14:45 - 16:15
Workshop 1 · Part 1
Cybercrime Atlas
Speaker: Jethro Cornelissen, Lead Investigator at Cybercrime Atlas
Speaker: Brenton Bowen, Director of Cyber Security Operations and Cyber Intelligence at Live Nation Entertainment
14:45 - 16:15
Workshop 2 · Part 1
OpenAI
Speaker: Amanda L., Threat Investigations Manager at OpenAI
16:15 - 16:35
Coffee break
16:35 - 18:00
Workshop 1 · Part 2
Cybercrime Atlas
Speaker: Jethro Cornelissen, Lead Investigator at Cybercrime Atlas
Speaker: Brenton Bowen, Director of Cyber Security Operations and Cyber Intelligence at Live Nation Entertainment
16:35 - 18:00
Workshop 2 · Part 2
OpenAI
Speaker: Amanda L., Threat Investigations Manager at OpenAI