CCA Blockchain Forensic Analysis 2 — Questions and Answers
Question 1: What is the primary purpose of a 'peeling chain' pattern in blockchain forensics?
- To obfuscate the origin of funds by repeatedly splitting and forwarding small amounts (Correct answer)
- To aggregate multiple small UTXOs into one large output
- To mark transactions with metadata for compliance tracking
- To identify mining pool addresses
Correct answer: To obfuscate the origin of funds by repeatedly splitting and forwarding small amounts
A peeling chain moves funds through a series of transactions where one output is sent onward and the remainder is kept, creating a chain that obscures the original source.
Question 2: Which heuristic assumes that all inputs in a Bitcoin transaction belong to the same wallet owner?
- Dust attack heuristic
- Common input ownership heuristic (CIOH) (Correct answer)
- Change address heuristic
- Round-number heuristic
Correct answer: Common input ownership heuristic (CIOH)
The Common Input Ownership Heuristic (CIOH) is a foundational blockchain clustering technique that groups addresses whose UTXOs are co-spent in the same transaction.
Question 3: In Ethereum forensics, what does analyzing the 'internal transactions' (traces) reveal that standard transaction logs do not?
- Gas price fluctuations across blocks
- Value transfers triggered by smart contract execution (Correct answer)
- Validator node identity for proof-of-stake blocks
- Token decimals and contract ABI definitions
Correct answer: Value transfers triggered by smart contract execution
Internal transactions (message calls) capture ETH movements that occur within smart contract logic and are not recorded as top-level transactions.
Question 4: A suspect uses a centralized mixer that pools funds from many users and redistributes equivalent amounts. Which forensic indicator most reliably links the deposit to the withdrawal?
- Identical transaction fees
- Timing correlation and matched denomination amounts (Correct answer)
- Reuse of the same receiving address
- Block confirmation depth
Correct answer: Timing correlation and matched denomination amounts
Timing analysis combined with denomination matching is the strongest available signal when a mixer disrupts direct UTXO linkage between deposit and withdrawal.
Question 5: What distinguishes a 'hot wallet' from a 'cold wallet' in the context of exchange forensics?
- Hot wallets hold fiat currency equivalents; cold wallets hold only stablecoins
- Hot wallets are internet-connected and used for daily operations; cold wallets are offline and hold reserves (Correct answer)
- Hot wallets use multisig; cold wallets use single-sig
- Hot wallets are custodial; cold wallets are always non-custodial
Correct answer: Hot wallets are internet-connected and used for daily operations; cold wallets are offline and hold reserves
Hot wallets remain online for operational liquidity, making them higher-risk targets, while cold wallets are air-gapped to protect bulk reserves.
Question 6: Which blockchain data element would a forensic analyst primarily use to identify a 'dusting attack' victim?
- Addresses that received tiny, unsolicited micro-transactions below the dust limit (Correct answer)
- Addresses with unusually high transaction fees
- Addresses that interacted with known DeFi protocols
- Addresses with more than 100 UTXOs
Correct answer: Addresses that received tiny, unsolicited micro-transactions below the dust limit
Dusting attacks send sub-dust amounts to target addresses so that if the victim later co-spends the dust, the attacker can cluster and deanonymize their wallet.
Question 7: When reconstructing a DeFi exploit on Ethereum, which tool provides the most granular trace of every internal call and state change during a specific transaction?
- Etherscan's basic transaction view
- A transaction debugger/tracer such as Tenderly or Foundry's cast run (Correct answer)
- A block explorer's token transfer tab
- The Ethereum JSON-RPC eth_getTransactionReceipt endpoint
Correct answer: A transaction debugger/tracer such as Tenderly or Foundry's cast run
Debuggers like Tenderly replay transactions step-by-step, exposing every CALL, DELEGATECALL, and storage slot change that a receipt or basic explorer view omits.
CCA Blockchain Forensic Analysis 2
What is the primary purpose of a 'peeling chain' pattern in blockchain forensics?