Cryptocurrency Security and Regulatory Compliance 3 — Questions and Answers
Question 1: What is the purpose of a crypto exchange's Proof of Reserves audit?
- To prove the exchange has paid its taxes
- To verify the exchange holds sufficient assets to cover customer balances (Correct answer)
- To confirm the exchange's smart contracts are bug-free
- To certify compliance with KYC regulations
Correct answer: To verify the exchange holds sufficient assets to cover customer balances
Proof of Reserves is a cryptographic audit allowing exchanges to demonstrate they hold 1:1 backing for customer funds without revealing individual balances.
Question 2: Which regulation requires U.S. taxpayers to report cryptocurrency transactions to the IRS?
- Bank Secrecy Act
- Internal Revenue Code Section 6050I (Correct answer)
- FATF Recommendation 16
- Dodd-Frank Act
Correct answer: Internal Revenue Code Section 6050I
IRS Section 6050I was updated in the Infrastructure Investment and Jobs Act to require reporting of digital asset transactions over $10,000 received in a trade or business.
Question 3: What is a 'replay attack' in the context of blockchain hard forks?
- Rebroadcasting a valid transaction from one chain to have it executed on the other chain (Correct answer)
- Attacking miners who replay old blocks
- Copying a smart contract from one network to another
- Replaying DDoS attacks from a previous network incident
Correct answer: Rebroadcasting a valid transaction from one chain to have it executed on the other chain
After a hard fork, a replay attack broadcasts a valid transaction from the original chain on the new chain, potentially draining funds on both chains simultaneously.
Question 4: What does OFAC's SDN list mean for crypto compliance?
- It lists sanctioned individuals and entities whose crypto addresses must be blocked (Correct answer)
- It catalogs approved cryptocurrency exchanges in the US
- It outlines suspicious digital asset transaction thresholds
- It defines standard disclosure norms for crypto companies
Correct answer: It lists sanctioned individuals and entities whose crypto addresses must be blocked
OFAC's Specially Designated Nationals list includes wallet addresses of sanctioned parties, and U.S. persons are prohibited from transacting with them.
Question 5: What is 'seed phrase' security best practice for self-custody wallets?
- Store the seed phrase in a password manager for easy access
- Never store it digitally; keep physical copies in secure offline locations (Correct answer)
- Share it with a trusted exchange as a backup
- Encrypt it and email it to yourself
Correct answer: Never store it digitally; keep physical copies in secure offline locations
Seed phrases should never be stored digitally; physical copies kept offline in fireproof or geographically distributed locations are the recommended practice.
Question 6: Under the EU's MiCA regulation, what are Crypto-Asset Service Providers (CASPs) required to obtain?
- A special FATF certification
- An authorization/license from their national competent authority (Correct answer)
- Approval from the European Central Bank
- A FinCEN MSB registration
Correct answer: An authorization/license from their national competent authority
MiCA (Markets in Crypto-Assets) requires CASPs to be authorized by the competent authority of their EU member state before offering services.
Question 7: What is a 'dusting attack' in cryptocurrency?
- Sending tiny amounts of crypto to wallets to track and de-anonymize their owners (Correct answer)
- A coordinated bot attack that inflates transaction fees
- Physically destroying hardware wallets
- Corrupting wallet software with malicious code updates
Correct answer: Sending tiny amounts of crypto to wallets to track and de-anonymize their owners
Attackers send small 'dust' amounts to many wallets, then analyze blockchain transactions to link addresses and de-anonymize wallet owners.
Cryptocurrency Security and Regulatory Compliance 3
What is the purpose of a crypto exchange's Proof of Reserves audit?