Cryptocurrency Fundamentals Flashcards

An investigator is analyzing a series of Bitcoin transactions related to a darknet market. They notice that a suspect's address receives 5 BTC. The suspect then sends 1.5 BTC to another address. In the context of the UTXO model, what best describes the state of the original 5 BTC?

Answer: The original 5 BTC UTXO is consumed, and two new UTXOs are created: one for 1.5 BTC and one for 3.5 BTC as change.

The Unspent Transaction Output (UTXO) model, used by Bitcoin, treats each transaction output as a discrete and indivisible chunk of cryptocurrency. When a user wants to spend from a UTXO, the entire output must be consumed. The transaction then creates new UTXOs: one for the payment amount to the recipient and another for the remaining amount (change) sent back to an address controlled by the sender.

Which of the following best describes the primary function of a cryptocurrency mixer or tumbler in a financial investigation context?

Answer: To pool and mix transactions from multiple users to obscure the trail of funds.

A cryptocurrency mixer, or tumbler, is a service that intentionally obscures the link between a sender and a recipient by pooling funds from many users and redistributing them. This process breaks the direct on-chain link, making it significantly harder for investigators to trace the flow of illicit funds.

A Certified Cryptocurrency Investigator is tasked with tracking the flow of funds from a ransomware attack. Which tool is essential for viewing transaction histories, wallet balances, and the movement of cryptocurrency on a public blockchain?

Answer: A block explorer

A block explorer is a web-based tool that functions like a search engine for a blockchain. It allows anyone to view detailed information about blocks, addresses, and transactions on the public ledger. For an investigator, this is a fundamental tool for tracing the path of cryptocurrency from one address to another.

A smaller, less-established Proof-of-Work (PoW) altcoin has experienced a sudden and significant reorganization of its blockchain, resulting in reversed transactions. This has allowed an attacker to double-spend a large amount of the altcoin. What type of attack has most likely occurred?

Answer: A 51% attack

A 51% attack occurs when a single entity or group gains control of more than 50% of a blockchain network's mining hash rate. This majority control allows them to manipulate the blockchain, including preventing new transactions, halting payments, and, most notably, reversing their own transactions to double-spend coins. Smaller PoW blockchains are more vulnerable due to the lower hash rate required to achieve a majority.

An investigator needs to advise a witness on how to securely store a large amount of cryptocurrency that will not be needed for frequent transactions. Which type of wallet would offer the highest level of security against online threats?

Answer: A hardware wallet.

A hardware wallet is a physical device that stores the user's private keys offline in a secure, isolated environment. Because the keys never touch an internet-connected computer, it is considered the most secure way to store cryptocurrency and protect it from online threats like malware and hacking. This is a form of 'cold storage'.

In the context of blockchain analysis, what is the primary goal of 'address clustering'?

Answer: To group multiple blockchain addresses that are likely controlled by the same individual or entity.

Address clustering is a key technique in blockchain forensics. It involves using heuristics and analysis to identify and group different cryptocurrency addresses that are likely under the control of a single entity. This allows investigators to build a more complete picture of a suspect's on-chain activity rather than viewing each address in isolation.