CCI Crypto Investigation Techniques 2

Question 1

A Bitcoin transaction spends five inputs from five different addresses. Which heuristic lets an investigator assume all five addresses belong to the same entity?

Accepted Answer

Common-input-ownership heuristic

Answer

Signing multiple inputs normally requires control of every private key, so co-spent inputs are usually clustered to one owner.

Question 2

Which privacy technique most directly undermines the common-input-ownership heuristic?

Accepted Answer

CoinJoin transactions

Answer

CoinJoin combines inputs from many unrelated users into one transaction, so co-spent inputs no longer imply a single owner.

Question 3

A transaction has two outputs: 0.50000000 BTC and 0.13729415 BTC. Absent other evidence, which output is most likely the change?

Accepted Answer

The 0.13729415 BTC output

Answer

Payments tend to be round amounts, so the odd, non-round output is more likely the change returned to the sender.

Question 4

An investigator sees a large balance move through dozens of hops, each sending a small amount out and the remainder to a fresh address. What pattern is this?

Accepted Answer

Peel chain

Answer

A peel chain repeatedly 'peels' small payments off a large balance while forwarding the remainder to a new change address.

Question 5

Why does address reuse benefit a blockchain investigator?

Accepted Answer

It links multiple transactions to the same identifiable address

Answer

Reusing an address ties all its transactions together, strengthening clustering and attribution.

CCI - Certified Cryptocurrency Investigator Practice Test

CCI - Certified Cryptocurrency Investigator Practice Test

CCI Crypto Investigation Techniques 2