CCI - Certified Cryptocurrency Investigator Blockchain Forensics and Analysis Questions and Answers

Question 1

An investigator is analyzing a series of Bitcoin transactions related to a darknet market seizure. They are using a blockchain analysis tool to trace the flow of funds. The investigator groups multiple addresses that are likely controlled by the same entity based on their transactional patterns. What is this specific forensic technique called?

Accepted Answer

Clustering

Answer

Clustering is a core technique in blockchain forensics used to group together multiple addresses that are likely controlled by the same entity. This is achieved by analyzing transaction patterns, such as co-spending of inputs, to deanonymize users and trace the flow of illicit funds. [10, 11]

Question 2

During the execution of a search warrant, a Certified Cryptocurrency Investigator discovers a small, USB-like device. The suspect claims it is a simple storage drive. However, the investigator suspects it is a hardware wallet. Which of the following is the MOST critical piece of information to obtain from the suspect to access the funds associated with this device?

Accepted Answer

The PIN or passphrase for the device

Answer

Hardware wallets are physical devices that store private keys offline. [1, 15] To access the wallet and authorize any transactions, an investigator would need the user's PIN, passphrase, or other authentication credentials. While other information is useful, the PIN/passphrase is the key to unlocking the device itself.

Question 3

Which of the following BEST describes the primary function of blockchain analysis platforms like Chainalysis, Elliptic, or TRM Labs in a forensic investigation?

Accepted Answer

To provide real-time risk scoring and trace the flow of funds across blockchains. [2]

Answer

Blockchain analysis platforms are specialized tools designed to de-anonymize transactions. Their primary function is to analyze blockchain data, trace the movement of funds, identify links between addresses and real-world entities, and provide risk scores for transactions associated with illicit activities like darknet markets or sanctioned addresses. [2, 6, 7]

Question 4

An investigator is examining the key differences between how Bitcoin and Ethereum record transactions for a fraud case. They note that Bitcoin transactions involve consuming previous outputs to create new ones, making it resemble a cash transaction. What is this model called?

Accepted Answer

Unspent Transaction Output (UTXO) Model

Answer

The Unspent Transaction Output (UTXO) model is used by Bitcoin. [22, 29, 30] In this model, transactions consume UTXOs from previous transactions and generate new UTXOs as outputs. This is distinct from the account-based model used by Ethereum, which maintains balances in accounts, similar to a bank ledger. [22, 28]

Question 5

A Certified Cryptocurrency Investigator is presenting evidence in a money laundering case. They need to explain how the suspect attempted to obscure the trail of stolen funds. The suspect sent their cryptocurrency to a service that pooled their funds with those of many other users before distributing them to new, clean addresses. What is this anonymization technique known as?

Accepted Answer

Mixing (or Tumbling)

Answer

Mixing, also known as tumbling, is a service that breaks the link between a sender and receiver by pooling transactions from multiple users and redistributing them. This makes it difficult for blockchain analysis tools to trace the original source of the funds, thereby enhancing anonymity. [17, 19]

CCI - Certified Cryptocurrency Investigator Practice Test

CCI - Certified Cryptocurrency Investigator Practice Test

CCI - Certified Cryptocurrency Investigator Blockchain Forensics and Analysis Questions and Answers