CCI Blockchain Forensics and Analysis 2

Question 1

An investigator sees a Bitcoin transaction with one input and two outputs, one of which is a round 0.5 BTC and the other 0.03817 BTC. Which output is most likely the change?

Accepted Answer

The 0.03817 BTC output

Answer

Round-number payment heuristics suggest the round amount was the intended payment, so the odd amount is likely change returning to the sender.

Question 2

What does the common-input-ownership heuristic assume?

Accepted Answer

All inputs spent together in one transaction are controlled by the same entity

Answer

Signing multiple inputs normally requires control of all their private keys, implying common ownership.

Question 3

Which transaction pattern most strongly undermines the common-input-ownership heuristic?

Accepted Answer

A CoinJoin transaction

Answer

CoinJoin deliberately combines inputs from many unrelated users into one transaction.

Question 4

A peel chain is best described as:

Accepted Answer

A series of transactions where a large balance repeatedly sends small amounts out while the remainder moves to a new address

Answer

Peel chains 'peel off' small payments while passing the bulk of funds forward, a common laundering and cash-out pattern.

Question 5

Why is the UTXO model generally easier to trace than an account-based model for following specific coins?

Accepted Answer

Each UTXO links explicitly to the prior transaction output that funded it

Answer

Every UTXO input references a specific previous output, creating an explicit transaction graph.

CCI - Certified Cryptocurrency Investigator Practice Test

CCI - Certified Cryptocurrency Investigator Practice Test

CCI Blockchain Forensics and Analysis 2