Crypto Investigation Techniques Flashcards

A Bitcoin transaction spends five inputs from five different addresses. Which heuristic lets an investigator assume all five addresses belong to the same entity?

Answer: Common-input-ownership heuristic

Signing multiple inputs normally requires control of every private key, so co-spent inputs are usually clustered to one owner.

Which privacy technique most directly undermines the common-input-ownership heuristic?

Answer: CoinJoin transactions

CoinJoin combines inputs from many unrelated users into one transaction, so co-spent inputs no longer imply a single owner.

A transaction has two outputs: 0.50000000 BTC and 0.13729415 BTC. Absent other evidence, which output is most likely the change?

Answer: The 0.13729415 BTC output

Payments tend to be round amounts, so the odd, non-round output is more likely the change returned to the sender.

An investigator sees a large balance move through dozens of hops, each sending a small amount out and the remainder to a fresh address. What pattern is this?

Answer: Peel chain

A peel chain repeatedly 'peels' small payments off a large balance while forwarding the remainder to a new change address.

Why does address reuse benefit a blockchain investigator?

Answer: It links multiple transactions to the same identifiable address

Reusing an address ties all its transactions together, strengthening clustering and attribution.

A transaction shows 100 outputs of exactly 0.1 BTC plus several odd-valued outputs. What does this most likely indicate?

Answer: A CoinJoin-style mixing transaction

Many equal-denomination outputs are the hallmark of CoinJoin implementations such as Wasabi or Whirlpool.

When a change-output candidate uses the same script type (e.g., bech32) as the inputs while the other output uses a different type, what can the investigator infer?

Answer: The matching-type output is likely the change

Wallets generally return change to the same address type they spend from, so the matching script type suggests change.