Cryptocurrency Tracing Techniques Flashcards

A Bitcoin transaction has two outputs: exactly 0.50000000 BTC and 0.03712844 BTC. Using the round-number heuristic, which output is most likely the change?

Answer: The 0.03712844 BTC output

Payments are often round amounts chosen by a person, so the odd-valued output is more likely the change returning to the sender.

What pattern best describes a 'peel chain' in Bitcoin tracing?

Answer: A large balance repeatedly spending a small amount off while the remainder moves to a new address

A peel chain peels small payments off a large UTXO in successive transactions, with the remaining change hopping to a fresh address each time.

Why does a CoinJoin transaction undermine the common-input-ownership heuristic?

Answer: It uses inputs from multiple independent users in a single transaction

Because CoinJoin combines inputs from different owners, assuming all inputs belong to one entity would produce false clustering.

An investigator sees inputs from P2WPKH (bc1q) addresses and two outputs: one P2WPKH and one P2PKH (starting with 1). Which output is more likely change?

Answer: The P2WPKH output

Wallets usually send change to the same script type as their inputs, so the output matching the input type is the likely change.

Under the 'poison' taint method, how is a transaction output treated if any input is from illicit funds?

Answer: The entire output is considered tainted

The poison method marks every output fully tainted if any tainted input contributes, which is simple but over-inclusive.

When tracing on Ethereum, why might a victim's funds appear to vanish when viewing only standard transactions on a block explorer?

Answer: ETH moved via smart contract calls appears as internal transactions, which require trace data

Value transfers triggered inside contract execution are recorded as internal transactions (traces), not top-level transactions.

What is the primary investigative value of address reuse by a suspect?

Answer: It links multiple transactions to the same entity, simplifying clustering

Reusing an address ties many receipts and spends together, giving investigators a stable identifier for one entity.