Blockchain Forensics and Analysis Flashcards

An investigator is analyzing a series of Bitcoin transactions related to a darknet market seizure. They are using a blockchain analysis tool to trace the flow of funds. The investigator groups multiple addresses that are likely controlled by the same entity based on their transactional patterns. What is this specific forensic technique called?

Answer: Clustering

Clustering is a core technique in blockchain forensics used to group together multiple addresses that are likely controlled by the same entity. This is achieved by analyzing transaction patterns, such as co-spending of inputs, to deanonymize users and trace the flow of illicit funds. [10, 11]

During the execution of a search warrant, a Certified Cryptocurrency Investigator discovers a small, USB-like device. The suspect claims it is a simple storage drive. However, the investigator suspects it is a hardware wallet. Which of the following is the MOST critical piece of information to obtain from the suspect to access the funds associated with this device?

Answer: The PIN or passphrase for the device

Hardware wallets are physical devices that store private keys offline. [1, 15] To access the wallet and authorize any transactions, an investigator would need the user's PIN, passphrase, or other authentication credentials. While other information is useful, the PIN/passphrase is the key to unlocking the device itself.

Which of the following BEST describes the primary function of blockchain analysis platforms like Chainalysis, Elliptic, or TRM Labs in a forensic investigation?

Answer: To provide real-time risk scoring and trace the flow of funds across blockchains. [2]

Blockchain analysis platforms are specialized tools designed to de-anonymize transactions. Their primary function is to analyze blockchain data, trace the movement of funds, identify links between addresses and real-world entities, and provide risk scores for transactions associated with illicit activities like darknet markets or sanctioned addresses. [2, 6, 7]

An investigator is examining the key differences between how Bitcoin and Ethereum record transactions for a fraud case. They note that Bitcoin transactions involve consuming previous outputs to create new ones, making it resemble a cash transaction. What is this model called?

Answer: Unspent Transaction Output (UTXO) Model

The Unspent Transaction Output (UTXO) model is used by Bitcoin. [22, 29, 30] In this model, transactions consume UTXOs from previous transactions and generate new UTXOs as outputs. This is distinct from the account-based model used by Ethereum, which maintains balances in accounts, similar to a bank ledger. [22, 28]

A Certified Cryptocurrency Investigator is presenting evidence in a money laundering case. They need to explain how the suspect attempted to obscure the trail of stolen funds. The suspect sent their cryptocurrency to a service that pooled their funds with those of many other users before distributing them to new, clean addresses. What is this anonymization technique known as?

Answer: Mixing (or Tumbling)

Mixing, also known as tumbling, is a service that breaks the link between a sender and receiver by pooling transactions from multiple users and redistributing them. This makes it difficult for blockchain analysis tools to trace the original source of the funds, thereby enhancing anonymity. [17, 19]

While examining a suspect's laptop, an investigator finds a text file containing a list of 24 random words. The investigator immediately recognizes this as a potentially critical piece of evidence. What is the most likely function of this list of words in the context of a cryptocurrency investigation?

Answer: A seed phrase used to restore a cryptocurrency wallet. [3, 4]

A seed phrase, or recovery phrase, is a list of 12 to 24 words that can be used to regenerate an entire cryptocurrency wallet, providing full access to the funds within it. [3] Finding a seed phrase is a critical discovery as it is equivalent to possessing the assets themselves. [1]