Story code: ST-000602
Part 3: He Knew Which Shortcut Mattered
The next morning I went back into the basement office before anyone else came downstairs and put the room in order one piece at a time. Chair centered. Mouse back on the right. Notebook squared with the keyboard. Cable laid flat beside the hardware wallet instead of plugged in. I repeated the sequence out loud as I checked it, because once a room has been crossed without permission, ordinary placement stops being ordinary.
Noah came by again after lunch. He stopped at the door, looked at the desk, and waited for me to hand him the wallet.
“Let’s keep it simple,” he said. “We verify what contact happened, then what access would have been needed.”
I unlocked the cabinet where I keep the wallet materials. Nothing was missing. The recovery phrase card was still sealed inside the small fire pouch where I leave it. The spare cable was still wrapped. The key to the cabinet was still on my ring upstairs.
That should have widened the possibilities. Instead it narrowed them.
If Evan had not gotten into the sealed backup materials, then whatever he did depended on what was already available in the room when I stepped away.
Noah had me walk through my normal setup from memory. Hardware wallet in the drawer unless I am checking balances. Cable coiled separately. Desktop app closed when I am done. Screen locked if I leave even for a minute. PIN entered only at the desk. No recovery phrase in the room. No passwords taped anywhere. No biometrics on the wallet.
He listened, then pointed to the monitor with two fingers without touching it. “Show me your lock settings.”
I did. Automatic lock after five minutes. Require password on wake. Normal.
Then he asked, “Yesterday, when you went upstairs for the package, did you lock it manually or just walk away?”
I paused there.
That was the kind of gap I hate because it is small enough to sound harmless. I could picture my coffee, my phone buzzing, the doorbell, the quick trip up the stairs. I could also picture the monitor still awake when I stood up.
“I don’t know,” I said. “I know I meant to. I don’t know if I did.”
Noah nodded once. He never uses a vague answer to make a bigger speech.
“Then test the machine, not your memory.”
We pulled the local desktop log and matched it to the wallet connection timestamp from the day before. Wake event. User activity. Wallet app opened. Short connection. App closed. No transfer. No address copied into the clipboard history. Nothing flashy. Just enough movement to show someone sat down and knew where to click.
I wrote each step in the notebook:
2:14 p.m. wake.
2:15 p.m. user activity.
2:16 p.m. wallet app open.
2:17 p.m. hardware wallet connection.
2:18 p.m. app close.
Noah looked at the sequence and said, “This isn’t random clicking. Whoever did it knew the app mattered.”
That was as far as he went, and it was enough.
The problem with family access is that people think recognition equals permission. Evan did not need a hidden tunnel or some cinematic hack. He needed a house he already moved through, a room he already treated like flexible space, and a minute when I was pulled upstairs. If my screen had remained unlocked, that minute was plenty.
When Evan came down that evening, he did what he had been doing since this started: he talked before I asked anything.
“Are we still doing this?”
He stood in the doorway this time instead of coming fully in. He kept one hand on the frame like that changed what had already happened.
I said, “You told me you barely stepped inside. Then you said you opened one or two drawers. Now I have a desktop wake event and a wallet connection during the exact window when Marlene heard you on the basement steps.”
He looked at Noah, then at me. “So what? You leave your crypto stuff out. I looked at the screen for two seconds. That doesn’t mean anything.”
It was the first useful sentence he had given me.
I had not said the machine woke. I had not said the app opened. I had not said someone looked at the screen. He supplied the screen on his own because broad denial no longer covered the path.
I asked, “If you only looked at the screen, why was my wallet cable plugged in?”
He folded his arms and answered too fast. “Maybe it already was.”
I picked up the notebook and read back my own line from the day before. “You asked if I wanted to do this over a cable before I ever mentioned one.”
His jaw shifted once. He did not answer.
Then Noah asked the smallest question in the room.
“How did you know the app wouldn’t do anything without the device unlocked?”
Evan’s head turned toward him sharply. “Because everybody knows that.”
Noah said, “Marlene wouldn’t. Most people wouldn’t. Someone who only wandered in for a charger wouldn’t be talking like the device was the issue.”
Evan pushed off the doorframe and gave that same loose half smile from the first day, except now it sat wrong on his face. “You two are acting insane over nothing.”
I did not raise my voice. I wrote one more line in the notebook instead.
He knew the screen mattered. He knew the device mattered. He knew the denial only worked if I could not prove the path.
Then I looked up and asked the one question that made him stop talking.
“Did you try my birthday on the wallet PIN, Evan?”