CCA Blockchain Forensic Analysis Questions and Answers

Question 1

An investigator is analyzing a Bitcoin wallet known to be associated with a ransomware attack.
They use a blockchain analysis tool that automatically groups several addresses together as being controlled by the same entity because they were all used as inputs in the same transaction.
What forensic principle is the tool applying?

Accepted Answer

The Common-Input-Ownership Heuristic

Answer

Taint analysis

Answer

UTXO consolidation mapping

Answer

Off-chain data correlation

Question 2

Which of the following represents the MOST significant challenge for a forensic analyst when tracing funds that have been processed through a privacy-enhancing protocol like CoinJoin?

Accepted Answer

The deterministic link between specific transaction inputs and outputs is broken.

Answer

The high transaction fees obscure the original amount.

Answer

The transaction is deleted from the blockchain after a set time.

Answer

The use of a centralized entity introduces a single point of failure for subpoenas.

Question 3

In the context of blockchain forensics, what does 'taint analysis' refer to?

Accepted Answer

A method for calculating the percentage of funds in an address that originates from a known illicit source.

Answer

The process of identifying smart contracts with known reentrancy vulnerabilities.

Answer

The technique of inserting malicious code into a block's metadata to corrupt the chain's history.

Answer

An audit procedure to verify the physical security of hardware wallets.

Question 4

A forensic auditor is investigating a theft of ETH from a corporate wallet. The on-chain analysis shows the stolen funds were sent to an address that immediately swapped the ETH for a stablecoin via a decentralized exchange (DEX). To continue the investigation, what is the auditor's most critical next step?

Accepted Answer

Analyzing the transaction graph to trace where the stablecoin was sent next.

Answer

Subpoenaing the DEX smart contract for the user's KYC information.

Answer

Reporting the DEX to have its liquidity pools frozen.

Answer

Waiting for the thief to deposit the stablecoin on a centralized exchange to be identified.

Question 5

Which of the following pieces of evidence in a cryptocurrency investigation would be exclusively considered 'off-chain' data?

Accepted Answer

An IP address log from a centralized exchange used by the suspect.

Answer

The timestamp of a Bitcoin block containing a fraudulent transaction.

Answer

The transaction hash (TxID) of a stolen payment.

Answer

A list of UTXOs controlled by a suspect's address.

Question 6

A forensic analyst uses transaction graph analysis to visually map the flow of cryptocurrency between addresses. What is the primary advantage of this technique?

Accepted Answer

It helps identify complex transaction patterns, intermediaries, and key entities like mixers or exchanges.

Answer

It guarantees the real-world identity of every address owner.

Answer

It automatically calculates the exact USD value of the funds at the time of each transfer.

Answer

It can be used to reverse illicit transactions on the blockchain.