CCI - Certified Cryptocurrency Investigator Cryptocurrency Fundamentals Questions and Answers — Questions and Answers
Question 1: An investigator is analyzing a series of Bitcoin transactions related to a darknet market. They notice that a suspect's address receives 5 BTC. The suspect then sends 1.5 BTC to another address. In the context of the UTXO model, what best describes the state of the original 5 BTC?
- The original 5 BTC UTXO is partially spent, with a remaining balance of 3.5 BTC.
- The original 5 BTC UTXO is consumed, and two new UTXOs are created: one for 1.5 BTC and one for 3.5 BTC as change. (Correct answer)
- The original 5 BTC UTXO is now linked to the recipient's address, and the sender's balance is debited by 1.5 BTC.
- The original 5 BTC UTXO is flagged as 'spent' and archived, while a new 1.5 BTC UTXO is created for the recipient.
Correct answer: The original 5 BTC UTXO is consumed, and two new UTXOs are created: one for 1.5 BTC and one for 3.5 BTC as change.
The Unspent Transaction Output (UTXO) model, used by Bitcoin, treats each transaction output as a discrete and indivisible chunk of cryptocurrency. When a user wants to spend from a UTXO, the entire output must be consumed. The transaction then creates new UTXOs: one for the payment amount to the recipient and another for the remaining amount (change) sent back to an address controlled by the sender.
Question 2: Which of the following best describes the primary function of a cryptocurrency mixer or tumbler in a financial investigation context?
- To exchange one type of cryptocurrency for another, such as Bitcoin for Monero.
- To pool and mix transactions from multiple users to obscure the trail of funds. (Correct answer)
- To provide a decentralized exchange platform for peer-to-peer trading.
- To split a large transaction into smaller, less conspicuous transactions.
Correct answer: To pool and mix transactions from multiple users to obscure the trail of funds.
A cryptocurrency mixer, or tumbler, is a service that intentionally obscures the link between a sender and a recipient by pooling funds from many users and redistributing them. This process breaks the direct on-chain link, making it significantly harder for investigators to trace the flow of illicit funds.
Question 3: A Certified Cryptocurrency Investigator is tasked with tracking the flow of funds from a ransomware attack. Which tool is essential for viewing transaction histories, wallet balances, and the movement of cryptocurrency on a public blockchain?
- A cold storage wallet
- A mining software client
- A decentralized application (dApp) browser
- A block explorer (Correct answer)
Correct answer: A block explorer
A block explorer is a web-based tool that functions like a search engine for a blockchain. It allows anyone to view detailed information about blocks, addresses, and transactions on the public ledger. For an investigator, this is a fundamental tool for tracing the path of cryptocurrency from one address to another.
Question 4: A smaller, less-established Proof-of-Work (PoW) altcoin has experienced a sudden and significant reorganization of its blockchain, resulting in reversed transactions. This has allowed an attacker to double-spend a large amount of the altcoin. What type of attack has most likely occurred?
- A phishing attack
- A 51% attack (Correct answer)
- A Sybil attack
- A Distributed Denial-of-Service (DDoS) attack
Correct answer: A 51% attack
A 51% attack occurs when a single entity or group gains control of more than 50% of a blockchain network's mining hash rate. This majority control allows them to manipulate the blockchain, including preventing new transactions, halting payments, and, most notably, reversing their own transactions to double-spend coins. Smaller PoW blockchains are more vulnerable due to the lower hash rate required to achieve a majority.
Question 5: An investigator needs to advise a witness on how to securely store a large amount of cryptocurrency that will not be needed for frequent transactions. Which type of wallet would offer the highest level of security against online threats?
- A mobile wallet on a smartphone.
- A custodial wallet on a major exchange.
- A hardware wallet. (Correct answer)
- A desktop software wallet.
Correct answer: A hardware wallet.
A hardware wallet is a physical device that stores the user's private keys offline in a secure, isolated environment. Because the keys never touch an internet-connected computer, it is considered the most secure way to store cryptocurrency and protect it from online threats like malware and hacking. This is a form of 'cold storage'.
Question 6: In the context of blockchain analysis, what is the primary goal of 'address clustering'?
- To group addresses that have transacted with each other within a specific timeframe.
- To identify all addresses that were created by the same type of wallet software.
- To determine which addresses are associated with known illicit entities like darknet markets.
- To group multiple blockchain addresses that are likely controlled by the same individual or entity. (Correct answer)
Correct answer: To group multiple blockchain addresses that are likely controlled by the same individual or entity.
Address clustering is a key technique in blockchain forensics. It involves using heuristics and analysis to identify and group different cryptocurrency addresses that are likely under the control of a single entity. This allows investigators to build a more complete picture of a suspect's on-chain activity rather than viewing each address in isolation.
CCI - Certified Cryptocurrency Investigator Cryptocurrency Fundamentals Questions and Answers
An investigator is analyzing a series of Bitcoin transactions related to a darknet market.
They notice that a suspect's address receives 5 BTC.
The suspect then sends 1.5 BTC to another address.
In the context of the UTXO model, what best describes the state of the original 5 BTC?