CCA Blockchain Forensic Analysis 3 — Questions and Answers
Question 1: What is 'address poisoning' in the context of cryptocurrency fraud investigation?
- Sending malware through a blockchain transaction's OP_RETURN field
- Creating a lookalike address with matching first/last characters to trick victims into sending funds to the wrong address (Correct answer)
- Blacklisting an address in a compliance database
- Flooding an address with spam transactions to raise its UTXO count
Correct answer: Creating a lookalike address with matching first/last characters to trick victims into sending funds to the wrong address
Address poisoning exploits copy-paste behavior by sending zero-value transactions from a vanity address that visually resembles the victim's counterparty address.
Question 2: In UTXO-based chain analysis, which output type is most commonly identified as a 'change output' returned to the sender?
- The output with the larger value
- The output with a non-round amount sent to a previously unused address (Correct answer)
- The output sent to the same address as an input
- The output with the highest script complexity
Correct answer: The output with a non-round amount sent to a previously unused address
Change outputs typically carry the residual non-round amount and are sent to a fresh address generated by the sender's wallet, distinguishing them from the payment output.
Question 3: Which technique do forensic analysts use to attribute blockchain addresses to real-world entities without a legal request to an exchange?
- Subpoena analysis
- Open-source intelligence (OSINT) combined with direct interaction transactions (Correct answer)
- Zero-knowledge proof verification
- Merkle proof extraction
Correct answer: Open-source intelligence (OSINT) combined with direct interaction transactions
OSINT (forums, social media, dark web markets) combined with controlled test transactions that interact with suspect addresses can attribute wallets to entities outside of formal legal process.
Question 4: A forensic report shows a wallet cluster sending funds through five intermediate hops before reaching a known exchange. This pattern most closely describes which stage of money laundering?
- Placement
- Layering (Correct answer)
- Integration
- Structuring
Correct answer: Layering
Layering involves moving funds through multiple transactions or intermediaries to obscure the audit trail and distance proceeds from their criminal origin.
Question 5: Which property of a public blockchain makes it fundamentally different from traditional financial records for forensic purposes?
- Blockchain records are encrypted and require decryption keys to read
- Blockchain records are immutable and permanently accessible without a court order (Correct answer)
- Blockchain records are stored only by the issuing institution
- Blockchain records are automatically purged after seven years
Correct answer: Blockchain records are immutable and permanently accessible without a court order
Public blockchains are permissionless ledgers where all historical data is permanently transparent, giving investigators indefinite access without needing to subpoena a custodian.
Question 6: What is the forensic significance of an 'unspent transaction output' (UTXO) that has never moved since being created three years ago?
- It indicates the private key is lost or the holder is a long-term holder (HODLer), and is typically excluded from active investigation (Correct answer)
- It is always associated with a mixing service
- It proves the address was used in a KYC-verified exchange deposit
- It confirms the transaction was processed off-chain
Correct answer: It indicates the private key is lost or the holder is a long-term holder (HODLer), and is typically excluded from active investigation
Long-dormant UTXOs may represent lost wallets, deceased holders, or deliberate holding strategies, and analysts must assess context before attributing intent.
Question 7: Which standard framework do U.S. federal agencies typically reference when conducting cryptocurrency tracing investigations and preparing court-admissible reports?
- ISO 27001
- NIST SP 800-101 (Guidelines on Mobile Device Forensics)
- FinCEN's BSA/AML examination manual supplemented by agency-specific SOPs (Correct answer)
- GDPR Article 17 data minimization guidelines
Correct answer: FinCEN's BSA/AML examination manual supplemented by agency-specific SOPs
U.S. agencies rely on FinCEN's BSA/AML framework and agency-specific standard operating procedures to ensure findings meet evidentiary standards in federal proceedings.
CCA Blockchain Forensic Analysis 3
What is 'address poisoning' in the context of cryptocurrency fraud investigation?