CCA Blockchain Forensic Analysis Questions and Answers

Question 1

An investigator is analyzing a Bitcoin wallet known to be associated with a ransomware attack. They use a blockchain analysis tool that automatically groups several addresses together as being controlled by the same entity because they were all used as inputs in the same transaction. What forensic principle is the tool applying?

Accepted Answer

The Common-Input-Ownership Heuristic

Answer

The Common-Input-Ownership Heuristic is a fundamental principle in blockchain forensics which assumes that if multiple addresses are used as inputs to a single transaction, they are all controlled by the same entity. This allows analysts to cluster addresses and map out an entity's wallet.

Question 2

Which of the following represents the MOST significant challenge for a forensic analyst when tracing funds that have been processed through a privacy-enhancing protocol like CoinJoin?

Accepted Answer

The deterministic link between specific transaction inputs and outputs is broken.

Answer

The primary purpose of a CoinJoin transaction is to break the ability to deterministically link inputs to outputs. It combines inputs from multiple users into a single, large transaction, making it computationally infeasible to prove which user's input funded a specific output, thus creating a major obstacle for tracing funds.

Question 3

In the context of blockchain forensics, what does 'taint analysis' refer to?

Accepted Answer

A method for calculating the percentage of funds in an address that originates from a known illicit source.

Answer

Taint analysis, or taint tracking, is a forensic method used to measure the degree of association between a specific cryptocurrency address or transaction and funds from sources flagged as illicit (e.g., darknet markets, scams, sanctioned wallets). It is often expressed as a percentage, representing the 'taint' of the funds.

Question 4

A forensic auditor is investigating a theft of ETH from a corporate wallet. The on-chain analysis shows the stolen funds were sent to an address that immediately swapped the ETH for a stablecoin via a decentralized exchange (DEX). To continue the investigation, what is the auditor's most critical next step?

Accepted Answer

Analyzing the transaction graph to trace where the stablecoin was sent next.

Answer

The most immediate and critical step is to continue tracing the funds on-chain. DEXs are decentralized protocols and do not hold user KYC information. The next transaction involving the stablecoin is the next piece of evidence and must be followed. While waiting for a CEX deposit is a valid long-term strategy, the immediate task is to follow the current on-chain trail.

Question 5

Which of the following pieces of evidence in a cryptocurrency investigation would be exclusively considered 'off-chain' data?

Accepted Answer

An IP address log from a centralized exchange used by the suspect.

Answer

On-chain data refers to information permanently recorded on the blockchain ledger itself, such as transaction hashes, addresses, amounts, and block timestamps. Off-chain data is information from external sources that are not part of the blockchain protocol, such as KYC documents, IP logs, and user account details held by centralized services like exchanges.

(CCA) Certified Cryptocurrency Auditor Practice Test

(CCA) Certified Cryptocurrency Auditor Practice Test

CCA Blockchain Forensic Analysis Questions and Answers