Cryptocurrency Transaction Auditing Flashcards

A suspicious transaction sends funds to a known darknet market address, then receives funds back after a delay. What technique is this most consistent with?

Answer: Round-trip transaction structuring

Round-trip transactions send funds to a complicit entity and receive them back, creating the appearance of legitimate commerce while obscuring the original source.

Which nonce characteristic in an Ethereum account would alert a CCA auditor to a potential transaction gap or out-of-order submission?

Answer: A nonce sequence with a missing integer (e.g., nonces 1, 2, 4 with no nonce 3)

Ethereum enforces sequential nonce ordering; a gap in nonces indicates a pending or dropped transaction that may have moved funds not yet visible on-chain.

What is the primary audit purpose of analyzing the 'change output' in a Bitcoin transaction?

Answer: Identifying the likely wallet address controlled by the transaction sender

The change output returns unspent funds to the sender's own wallet, and identifying it helps auditors separate recipient addresses from the sender's address cluster.

When auditing a Proof-of-Stake validator, which on-chain data source reveals whether the validator engaged in slashable double-signing behavior?

Answer: Slashing events recorded in the beacon chain or consensus layer

Slashing events are explicitly recorded in the consensus layer (e.g., Ethereum beacon chain) and indicate that a validator signed two conflicting blocks or attestations.

A CCA auditor is reviewing a stablecoin issuer. Which audit procedure best verifies that the stablecoin supply matches the underlying reserve assets?

Answer: Reconciling on-chain total token supply against independently verified reserve attestation reports

Reconciling the on-chain minted supply against third-party attested reserves is the only procedure that links blockchain data to real-world backing.

Which of the following best describes a 'layering' stage red flag specific to cryptocurrency transactions?

Answer: Rapid sequential transfers through multiple wallets or exchanges across different blockchains with no apparent business purpose

Rapid multi-hop transfers across wallets and chains with no economic rationale are a classic layering technique to distance funds from their illicit origin.

What does a high 'realized cap' relative to 'market cap' in a cryptocurrency suggest from an audit perspective?

Answer: Most coins were last moved at prices close to or above current market price, indicating limited paper gains

When realized cap approaches market cap, it means coins were acquired at prices near current levels, suggesting limited speculative bubble dynamics at the population level.