CCI - Certified Cryptocurrency Investigator Cryptocurrency Fundamentals Questions and Answers

Question 1

An investigator is analyzing a series of Bitcoin transactions related to a darknet market. They notice that a suspect's address receives 5 BTC. The suspect then sends 1.5 BTC to another address. In the context of the UTXO model, what best describes the state of the original 5 BTC?

Accepted Answer

The original 5 BTC UTXO is consumed, and two new UTXOs are created: one for 1.5 BTC and one for 3.5 BTC as change.

Answer

The Unspent Transaction Output (UTXO) model, used by Bitcoin, treats each transaction output as a discrete and indivisible chunk of cryptocurrency. When a user wants to spend from a UTXO, the entire output must be consumed. The transaction then creates new UTXOs: one for the payment amount to the recipient and another for the remaining amount (change) sent back to an address controlled by the sender.

Question 2

Which of the following best describes the primary function of a cryptocurrency mixer or tumbler in a financial investigation context?

Accepted Answer

To pool and mix transactions from multiple users to obscure the trail of funds.

Answer

A cryptocurrency mixer, or tumbler, is a service that intentionally obscures the link between a sender and a recipient by pooling funds from many users and redistributing them. This process breaks the direct on-chain link, making it significantly harder for investigators to trace the flow of illicit funds.

Question 3

A Certified Cryptocurrency Investigator is tasked with tracking the flow of funds from a ransomware attack. Which tool is essential for viewing transaction histories, wallet balances, and the movement of cryptocurrency on a public blockchain?

Accepted Answer

A block explorer

Answer

A block explorer is a web-based tool that functions like a search engine for a blockchain. It allows anyone to view detailed information about blocks, addresses, and transactions on the public ledger. For an investigator, this is a fundamental tool for tracing the path of cryptocurrency from one address to another.

Question 4

A smaller, less-established Proof-of-Work (PoW) altcoin has experienced a sudden and significant reorganization of its blockchain, resulting in reversed transactions. This has allowed an attacker to double-spend a large amount of the altcoin. What type of attack has most likely occurred?

Accepted Answer

A 51% attack

Answer

A 51% attack occurs when a single entity or group gains control of more than 50% of a blockchain network's mining hash rate. This majority control allows them to manipulate the blockchain, including preventing new transactions, halting payments, and, most notably, reversing their own transactions to double-spend coins. Smaller PoW blockchains are more vulnerable due to the lower hash rate required to achieve a majority.

Question 5

An investigator needs to advise a witness on how to securely store a large amount of cryptocurrency that will not be needed for frequent transactions. Which type of wallet would offer the highest level of security against online threats?

Accepted Answer

A hardware wallet.

Answer

A hardware wallet is a physical device that stores the user's private keys offline in a secure, isolated environment. Because the keys never touch an internet-connected computer, it is considered the most secure way to store cryptocurrency and protect it from online threats like malware and hacking. This is a form of 'cold storage'.

CCI - Certified Cryptocurrency Investigator Practice Test

CCI - Certified Cryptocurrency Investigator Practice Test

CCI - Certified Cryptocurrency Investigator Cryptocurrency Fundamentals Questions and Answers