CCI - Certified Cryptocurrency Investigator Privacy Coins and Anonymity Questions and Answers — Questions and Answers
Question 1: An investigator traces illicit funds to a Zcash address. However, upon examining the transaction on a block explorer, the sender, receiver, and amount are all encrypted. This indicates the funds were sent to which type of address?
- A t-address (transparent)
- A z-address (shielded) (Correct answer)
- A multi-signature address
- A Tor-gapped address
Correct answer: A z-address (shielded)
Zcash has two types of addresses: transparent (t-addresses), which are public and traceable like Bitcoin, and shielded (z-addresses), which use zero-knowledge proofs (zk-SNARKs) to encrypt transaction details. When sender, receiver, and amount are obscured, it signifies a transaction involving a shielded z-address.
Question 2: Which privacy-enhancing technology, central to Monero, makes it computationally infeasible for an outside observer to determine which of a group of possible signers actually authorized a transaction?
- Stealth Addresses
- zk-SNARKs
- CoinJoin
- Ring Signatures (Correct answer)
Correct answer: Ring Signatures
Ring signatures are a cryptographic method used by Monero that mixes a user's transaction with a number of other outputs (decoys) from the blockchain. This creates a 'ring' of plausible signers, making it impossible to determine the true origin of the transaction without additional information.
Question 3: An investigator analyzing the Bitcoin blockchain encounters a single large transaction with numerous inputs and outputs of identical value. This structure makes it difficult to apply the common-input-ownership heuristic. Which privacy technique was most likely used?
- CoinJoin (Correct answer)
- Chain Hopping
- Dandelion++ Protocol
- Ring Confidential Transactions (RingCT)
Correct answer: CoinJoin
CoinJoin is a method where multiple users combine their transactions into a single, larger transaction to obscure the original flow of funds. By mixing multiple inputs and outputs, it breaks the link between a specific sender and receiver, frustrating blockchain analysis.
Question 4: What is the primary function of a "stealth address" as implemented in privacy coins like Monero?
- To encrypt the transaction amount so it cannot be viewed on the blockchain.
- To mix the sender's digital signature with decoys to obscure the origin.
- To generate a unique, one-time public address for each transaction to protect the recipient's privacy. (Correct answer)
- To broadcast transactions through a series of nodes to hide the originating IP address.
Correct answer: To generate a unique, one-time public address for each transaction to protect the recipient's privacy.
Stealth addresses are used to protect the privacy of the transaction recipient. For every transaction, a new, single-use address is created that is only accessible by the recipient. This prevents an outside observer from linking multiple payments to the same person's public address.
Question 5: A Certified Cryptocurrency Investigator is assigned a case where a ransomware payment was made using Monero. The victim provides the transaction ID. What is the most significant challenge the investigator will face when attempting to trace the funds on the public ledger?
- The transaction fees are too high for analysis tools to process.
- Monero's block time is too slow, causing significant data retrieval delays.
- The sender's address, recipient's address, and transaction amount are all obscured by default. (Correct answer)
- The transaction ID is encrypted and can only be viewed by the Monero development team.
Correct answer: The sender's address, recipient's address, and transaction amount are all obscured by default.
Monero is private by default, meaning every transaction automatically uses Ring Signatures (hiding the sender), Stealth Addresses (hiding the receiver), and RingCT (hiding the amount). Therefore, even with a transaction ID, an investigator cannot see the critical details of the transaction on the public blockchain, making it extremely difficult to trace.
Question 6: Some privacy-focused cryptocurrencies implement the Dandelion++ protocol. What specific aspect of a transaction does this protocol aim to obscure?
- The on-chain link between the sender and receiver.
- The total value of cryptocurrency held in a user's wallet.
- The identity of the miner who includes the transaction in a block.
- The originating IP address from which the transaction was first broadcast. (Correct answer)
Correct answer: The originating IP address from which the transaction was first broadcast.
Dandelion++ is a network-level privacy protocol designed to protect against deanonymization attacks that link transactions to IP addresses. It works by first passing a transaction through a series of nodes privately (the 'stem' phase) before broadcasting it widely to the network (the 'fluff' phase), making it difficult to pinpoint the source IP.
CCI - Certified Cryptocurrency Investigator Privacy Coins and Anonymity Questions and Answers
An investigator traces illicit funds to a Zcash address.
However, upon examining the transaction on a block explorer, the sender, receiver, and amount are all encrypted.
This indicates the funds were sent to which type of address?