CCI - Certified Cryptocurrency Investigator Crypto Investigation Techniques Questions and Answers

Question 1

An investigator obtains transaction records from a major centralized exchange. The records show a suspect frequently traded large amounts of ETH for USDT and back again within a single day. However, a review of the suspect's known Ethereum deposit address on a public blockchain explorer shows no corresponding on-chain transactions for these trades. What is the most likely explanation for this discrepancy?

Accepted Answer

The trades were executed off-chain on the exchange's internal ledger.

Answer

Centralized exchanges (CEXs) typically record trades between users on their own private, internal ledgers (off-chain). This allows for high-speed, low-cost trading. An on-chain transaction only occurs when a user deposits funds to the exchange or withdraws funds from it. Therefore, the absence of these trades on the public blockchain is expected behavior.

Question 2

While analyzing a major DeFi exploit on the Ethereum blockchain, an investigator observes the attacker's transaction. It shows that the attacker's malicious smart contract called the 'withdraw' function on the victim's protocol. Before the victim's protocol could update the attacker's balance, the attacker's contract repeatedly called the 'withdraw' function again within the same transaction, draining the protocol's funds. This vulnerability is best described as what type of attack?

Accepted Answer

A reentrancy attack

Answer

A reentrancy attack occurs when a function in a smart contract makes an external call to another untrusted contract before it resolves any effects on its own state. This allows the untrusted contract to call back into the original function multiple times before the initial invocation is complete, leading to exploits like draining funds, as described in the scenario.

Question 3

During a digital forensic examination of a suspect's computer running Windows, an investigator is searching for evidence of a Bitcoin Core software wallet. Which of the following files, typically found in the AppData\Roaming\Bitcoin directory, is the most critical artifact to secure as it contains the wallet's private keys?

Accepted Answer

wallet.dat

Answer

The wallet.dat file is the most critical file for a Bitcoin Core client. It contains the user's private keys, public keys, addresses, and transaction records. Securing this file (and the passphrase to unlock it) gives an investigator control over the cryptocurrency funds associated with that wallet.

Question 4

Which of the following money laundering techniques is defined by the use of cross-chain bridges or decentralized services to move illicit funds from one blockchain to another (e.g., from Bitcoin to Ethereum to Monero) in an attempt to break the forensic trail?

Accepted Answer

Chain hopping

Answer

Chain hopping is the specific term for moving crypto assets between different blockchains to obscure their origin and path. This is distinct from mixing or tumbling, which typically anonymizes transactions within the same blockchain. Chain hopping exploits the disconnected nature of different ledgers to make tracing more difficult for investigators.

Question 5

A Virtual Asset Service Provider (VASP) is obligated under the BSA's 'Travel Rule' to collect, retain, and transmit specific information about fund transfers to the next financial institution. What is the primary purpose of this regulation in the context of a crypto investigation?

Accepted Answer

To create an information trail and prevent gaps in transaction data that could be exploited for money laundering.

Answer

The primary purpose of the Travel Rule, as enforced by FinCEN, is to preserve an information trail for fund transfers between financial institutions (including VASPs). This ensures that law enforcement can follow the flow of funds and have access to originator and beneficiary information, which is critical for investigating money laundering, terrorist financing, and other financial crimes.

CCI - Certified Cryptocurrency Investigator Practice Test

CCI - Certified Cryptocurrency Investigator Practice Test

CCI - Certified Cryptocurrency Investigator Crypto Investigation Techniques Questions and Answers