Blockchain Forensic Analysis Flashcards

Which type of blockchain explorer data would a forensic analyst use to confirm that a specific smart contract was self-destructed after a rug pull?

Answer: A SELFDESTRUCT opcode execution recorded in the contract's internal transaction trace

The SELFDESTRUCT opcode destroys a contract's bytecode and sends remaining ETH to a designated address; its execution is captured in internal transaction traces.

A forensic investigator identifies a wallet that periodically receives Bitcoin from a mining pool and never interacts with exchanges. What is the most accurate classification of this entity?

Answer: Cryptocurrency miner holding self-mined coins

Regular, consistent coinbase-derived inflows from a mining pool with no exchange withdrawals is the classic on-chain signature of a miner accumulating self-mined coins.

What is the forensic role of the 'memo' or 'destination tag' field used in XRP (Ripple) transactions?

Answer: It identifies the end recipient sub-account at a custodial service, enabling investigators to link deposits to specific users

Custodial exchanges use a shared XRP address with unique destination tags per user, making the tag a critical field for investigators to tie a deposit to a specific account holder.

In the context of NFT wash trading investigations, which on-chain pattern is the strongest indicator of artificial volume inflation?

Answer: The same wallet addresses repeatedly buying and selling the same NFT between each other at escalating prices

Circular trading between controlled wallets—especially with rising prices—is the hallmark of wash trading designed to inflate reported volume and perceived value.

Which blockchain forensic methodology involves submitting a small, deliberate transaction to a suspect address to confirm liveness and later trace any co-spend?

Answer: Controlled interaction / probe transaction technique

A probe transaction sends a traceable amount to the suspect address so that any subsequent co-spend reveals associated addresses and potentially identifies the controlling wallet.

An exchange's compliance team flags a wallet that received funds from both a known ransomware address and a peer-to-peer trading platform. Which FATF-aligned risk indicator does this most directly trigger?

Answer: Exposure to illicit sources combined with obfuscation through unregulated intermediaries

FATF red-flag indicators include direct or indirect exposure to criminal wallets and use of unregulated P2P platforms that obscure beneficial ownership.

What is the primary reason forensic analysts prefer using a blockchain analytics platform (e.g., Chainalysis, Elliptic) over manual block explorer analysis for large investigations?

Answer: Platforms provide pre-attributed entity clusters, automated risk scoring, and graph visualization that would take weeks to replicate manually

Commercial platforms aggregate years of attributed address clusters, KYC data from cooperative exchanges, and automated heuristics into tools that dramatically accelerate large-scale investigations.