Blockchain Forensics and Analysis Flashcards

An investigator sees a Bitcoin transaction with one input and two outputs, one of which is a round 0.5 BTC and the other 0.03817 BTC. Which output is most likely the change?

Answer: The 0.03817 BTC output

Round-number payment heuristics suggest the round amount was the intended payment, so the odd amount is likely change returning to the sender.

What does the common-input-ownership heuristic assume?

Answer: All inputs spent together in one transaction are controlled by the same entity

Signing multiple inputs normally requires control of all their private keys, implying common ownership.

Which transaction pattern most strongly undermines the common-input-ownership heuristic?

Answer: A CoinJoin transaction

CoinJoin deliberately combines inputs from many unrelated users into one transaction.

A peel chain is best described as:

Answer: A series of transactions where a large balance repeatedly sends small amounts out while the remainder moves to a new address

Peel chains 'peel off' small payments while passing the bulk of funds forward, a common laundering and cash-out pattern.

Why is the UTXO model generally easier to trace than an account-based model for following specific coins?

Answer: Each UTXO links explicitly to the prior transaction output that funded it

Every UTXO input references a specific previous output, creating an explicit transaction graph.

On Ethereum, which data source is most useful for tracing token transfers that do not appear as native ETH value movements?

Answer: ERC-20 Transfer event logs

Token movements are recorded as Transfer events emitted by the token contract, not as ETH value fields.

An address cluster shows thousands of deposit addresses that each forward funds to one hot wallet. This most likely indicates:

Answer: A centralized exchange deposit structure

Exchanges typically assign unique deposit addresses per user and sweep them to a central hot wallet.