CCI Cryptocurrency Tracing Techniques 2

Question 1

A Bitcoin transaction has two outputs: exactly 0.50000000 BTC and 0.03712844 BTC. Using the round-number heuristic, which output is most likely the change?

Accepted Answer

The 0.03712844 BTC output

Answer

Payments are often round amounts chosen by a person, so the odd-valued output is more likely the change returning to the sender.

Question 2

What pattern best describes a 'peel chain' in Bitcoin tracing?

Accepted Answer

A large balance repeatedly spending a small amount off while the remainder moves to a new address

Answer

A peel chain peels small payments off a large UTXO in successive transactions, with the remaining change hopping to a fresh address each time.

Question 3

Why does a CoinJoin transaction undermine the common-input-ownership heuristic?

Accepted Answer

It uses inputs from multiple independent users in a single transaction

Answer

Because CoinJoin combines inputs from different owners, assuming all inputs belong to one entity would produce false clustering.

Question 4

An investigator sees inputs from P2WPKH (bc1q) addresses and two outputs: one P2WPKH and one P2PKH (starting with 1). Which output is more likely change?

Accepted Answer

The P2WPKH output

Answer

Wallets usually send change to the same script type as their inputs, so the output matching the input type is the likely change.

Question 5

Under the 'poison' taint method, how is a transaction output treated if any input is from illicit funds?

Accepted Answer

The entire output is considered tainted

Answer

The poison method marks every output fully tainted if any tainted input contributes, which is simple but over-inclusive.

CCI - Certified Cryptocurrency Investigator Practice Test

CCI - Certified Cryptocurrency Investigator Practice Test

CCI Cryptocurrency Tracing Techniques 2