CCA Cryptocurrency Exchange & Custody Auditing 2 — Questions and Answers
Question 1: What is the primary purpose of a Merkle tree proof in a cryptocurrency exchange proof-of-reserves audit?
- To allow individual users to verify their balance is included in the total reserve without revealing other users' data (Correct answer)
- To encrypt private keys stored in cold wallets
- To speed up blockchain transaction confirmations
- To generate new wallet addresses for customers
Correct answer: To allow individual users to verify their balance is included in the total reserve without revealing other users' data
A Merkle tree proof lets each customer verify their specific balance is included in the aggregated reserve total while keeping all other users' balances private.
Question 2: An auditor finds that exchange withdrawal approval requires only a single authorized employee's digital signature. Which control framework principle does this violate?
- Segregation of duties (Correct answer)
- Least privilege
- Defense in depth
- Data integrity
Correct answer: Segregation of duties
Requiring only one approver for withdrawals violates segregation of duties, as a single actor can unilaterally move customer assets without independent oversight.
Question 3: Which type of wallet arrangement presents the highest operational security risk for a cryptocurrency custodian?
- Hot wallet with keys stored on an internet-connected server (Correct answer)
- Multi-signature cold wallet requiring 3-of-5 key holders
- Hardware security module (HSM) protected wallet
- Air-gapped hardware wallet stored in a bank vault
Correct answer: Hot wallet with keys stored on an internet-connected server
Hot wallets with keys on internet-connected servers are the highest risk because network exposure makes private keys vulnerable to remote theft or hacking.
Question 4: During an exchange audit, the auditor notices customer deposit addresses are reused for multiple clients. What is the primary audit concern?
- It makes it impossible to attribute individual deposits to customers without off-chain ledger records (Correct answer)
- It increases blockchain transaction fees
- It slows down deposit confirmations
- It violates exchange licensing requirements
Correct answer: It makes it impossible to attribute individual deposits to customers without off-chain ledger records
Reusing deposit addresses across multiple customers means that on-chain data alone cannot identify which customer made a deposit, creating a complete reliance on the exchange's internal records for attribution.
Question 5: A cryptocurrency exchange's audit reveals a discrepancy between the on-chain wallet balance and the internal customer ledger. What is the auditor's immediate next step?
- Trace all deposits and withdrawals on-chain against ledger entries to identify the source of the discrepancy (Correct answer)
- Issue an immediate qualified opinion
- Report the exchange to FinCEN
- Suspend the audit pending management explanation
Correct answer: Trace all deposits and withdrawals on-chain against ledger entries to identify the source of the discrepancy
The auditor should perform a detailed on-chain trace to reconcile every transaction against the internal ledger to identify whether the discrepancy is a recording error, theft, or fraud.
Question 6: What is 'rehypothecation risk' in the context of cryptocurrency custody auditing?
- The risk that a custodian pledges or lends customer assets without their knowledge or consent (Correct answer)
- The risk of private key exposure during hardware wallet generation
- The risk of price manipulation on thinly traded assets
- The risk of regulatory changes affecting custody requirements
Correct answer: The risk that a custodian pledges or lends customer assets without their knowledge or consent
Rehypothecation risk is the danger that a custodian uses customer-deposited assets as collateral or loans them out, meaning they may not be fully available when customers request withdrawal.
CCA Cryptocurrency Exchange & Custody Auditing 2
What is the primary purpose of a Merkle tree proof in a cryptocurrency exchange proof-of-reserves audit?