CCI Investigative Procedures 2 — Questions and Answers
Question 1: An investigator identifies that stolen funds landed in a deposit address at a U.S.-based exchange. What is the best first legal step to keep the account records from being deleted while formal process is prepared?
- Email the account holder asking for cooperation
- Send a preservation request under 18 U.S.C. § 2703(f) (Correct answer)
- Post the address on social media to warn the public
- Wait until a grand jury subpoena is issued
Correct answer: Send a preservation request under 18 U.S.C. § 2703(f)
A 2703(f) preservation letter obligates the provider to preserve existing records for 90 days, renewable, pending legal process.
Question 2: During a search warrant, agents find a sheet of paper with 24 English words written on it. How should this item be treated?
- As a public address safe to share with the exchange
- As a potential BIP-39 seed phrase giving full control of the wallet (Correct answer)
- As a password only usable on the suspect's laptop
- As irrelevant notes to be left at the scene
Correct answer: As a potential BIP-39 seed phrase giving full control of the wallet
A 12- or 24-word mnemonic can regenerate a wallet's private keys, so it must be secured and documented as high-value evidence.
Question 3: Why should investigators record transaction timestamps in UTC when documenting blockchain activity?
- UTC timestamps are required to broadcast a transaction
- UTC prevents miners from altering block times
- Block timestamps are recorded in UTC, avoiding time-zone conversion errors in reports (Correct answer)
- Exchanges reject subpoenas that use local time
Correct answer: Block timestamps are recorded in UTC, avoiding time-zone conversion errors in reports
Using UTC aligns report times with on-chain data and exchange logs, preventing discrepancies across jurisdictions.
Question 4: A suspect's funds were converted to USDT on Ethereum and sit in a self-hosted wallet. Which action may allow investigators to freeze them quickly?
- Request that Tether blacklist the address through law enforcement channels (Correct answer)
- Ask Ethereum miners to reject the wallet's transactions
- File a chargeback with the suspect's bank
- Contact the hardware wallet manufacturer
Correct answer: Request that Tether blacklist the address through law enforcement channels
Centralized stablecoin issuers like Tether and Circle can freeze tokens at specific addresses upon law enforcement request.
Question 5: Which practice best preserves chain of custody when seizing cryptocurrency from a suspect's wallet?
- Leave funds in the suspect wallet and photograph the balance
- Move funds to the lead investigator's personal exchange account
- Write down the balance and seize only the phone
- Transfer funds to a government-controlled wallet, documenting TXIDs, witnesses, and times (Correct answer)
Correct answer: Transfer funds to a government-controlled wallet, documenting TXIDs, witnesses, and times
Moving assets to an agency-controlled wallet with full documentation prevents dissipation and creates a verifiable custody record.
Question 6: An exchange responds that it requires a different type of legal process to disclose stored transaction content and account details. Under the Stored Communications Act, which process generally compels basic subscriber information?
- A pen register order only
- A civil demand letter
- A subpoena (Correct answer)
- A Title III wiretap order
Correct answer: A subpoena
Basic subscriber records such as name, address, and payment method can generally be obtained with a subpoena under 18 U.S.C. § 2703(c)(2).
Question 7: When reporting a blockchain tracing finding, what should an investigator include so another analyst can independently verify it?
- A screenshot of a price chart
- Only the final dollar amount traced
- Transaction hashes, addresses, block heights, and the heuristics applied (Correct answer)
- The analyst's opinion without supporting data
Correct answer: Transaction hashes, addresses, block heights, and the heuristics applied
Reproducible reports cite exact on-chain identifiers and the methodology used so findings can be validated.
