So, what about prosecution of criminal acts?

You have to look at things separately.

On one side there is the blockchain, which is decentralized and which has its own activity, controlled by the code. Since this part is really decent, it is up to the victim of malicious actions to file a complaint.

On the other side, there are different clients (steemit.com, busy.org, esteem, ...) that are used to access blockchain information and to manage the activity of their own account. These customers are centralized and it is up to them to take the necessary security measures to protect their users.

Concerning the possibility of complaints, it is unfortunately difficult to prove which client has been used to perform actions. And hacking has often been made possible due to the negligence of the user.

Finally, it is hard to clearly identify the criminals.

It is therefore likely to be a legal puzzle.