CCA Cryptocurrency Transaction Auditing 2 — Questions and Answers
Question 1: Which on-chain metric best indicates a transaction is part of a 'peel chain' technique used to obscure fund origins?
- A single input splitting into many equal outputs
- A series of transactions where each has one input and one output with decreasing amounts (Correct answer)
- Multiple inputs combined into a single output
- A transaction with no change output
Correct answer: A series of transactions where each has one input and one output with decreasing amounts
A peel chain involves peeling off small amounts across sequential one-in-one-out transactions, gradually reducing the main UTXO to evade tracing.
Question 2: When auditing a DeFi protocol, which event log field is most critical for reconstructing the exact token swap amounts in an AMM transaction?
- The block timestamp
- The Swap event's amount0In, amount0Out, amount1In, amount1Out fields (Correct answer)
- The transaction gas price
- The contract deployer address
Correct answer: The Swap event's amount0In, amount0Out, amount1In, amount1Out fields
AMM Swap events emit exact input and output token amounts for each side, making them the authoritative source for reconstructing swap economics.
Question 3: A CCA auditor notices a Bitcoin transaction with hundreds of inputs from different addresses consolidating into one output. What AML concern does this most likely indicate?
- Coin splitting for privacy
- CoinJoin mixing to obfuscate fund origins (Correct answer)
- A mining pool payout
- A dust attack on multiple wallets
Correct answer: CoinJoin mixing to obfuscate fund origins
CoinJoin transactions consolidate inputs from multiple parties to break the transaction graph link between inputs and outputs, a common mixing technique.
Question 4: Under FATF Travel Rule requirements, what minimum threshold triggers the obligation for VASPs to transmit originator and beneficiary information?
- $500 USD or equivalent
- $1,000 USD or equivalent (Correct answer)
- $3,000 USD or equivalent
- $10,000 USD or equivalent
Correct answer: $1,000 USD or equivalent
FATF Recommendation 16 sets the Travel Rule threshold at USD/EUR 1,000 for virtual asset transfers between VASPs.
Question 5: An auditor is tracing funds through a cross-chain bridge. Which characteristic of bridge transactions makes attribution most challenging?
- Bridges always use the same address on both chains
- Lock-and-mint mechanisms break the direct on-chain link between source and destination chains (Correct answer)
- Bridge fees are always negligible
- Bridge transactions are always publicly documented
Correct answer: Lock-and-mint mechanisms break the direct on-chain link between source and destination chains
Lock-and-mint bridges lock assets on the source chain and mint wrapped tokens on the destination chain, creating two separate on-chain records with no direct cryptographic link.
Question 6: Which method is most effective for identifying address clusters belonging to the same entity on the Bitcoin network?
- Analyzing transaction timestamps
- Common input ownership heuristic (co-spending analysis) (Correct answer)
- Examining block height at transaction confirmation
- Reviewing the OP_RETURN field
Correct answer: Common input ownership heuristic (co-spending analysis)
The common input ownership heuristic assumes all input addresses in a transaction are controlled by the same entity, enabling address clustering.
Question 7: When reviewing Ethereum internal transactions (traces), what scenario requires an auditor to examine traces rather than top-level transactions?
- Identifying the transaction sender
- Detecting ETH transfers triggered by smart contract logic, not direct EOA sends (Correct answer)
- Verifying block producer identity
- Checking the gas limit
Correct answer: Detecting ETH transfers triggered by smart contract logic, not direct EOA sends
Internal transactions are ETH or token movements initiated by smart contract execution and do not appear in the standard transaction list, only in execution traces.
CCA Cryptocurrency Transaction Auditing 2
Which on-chain metric best indicates a transaction is part of a 'peel chain' technique used to obscure fund origins?