CCA Cryptocurrency Transaction Auditing 3 — Questions and Answers
Question 1: A suspicious transaction sends funds to a known darknet market address, then receives funds back after a delay. What technique is this most consistent with?
- Layering through an exchange
- Round-trip transaction structuring (Correct answer)
- Dollar-cost averaging
- Lightning Network routing
Correct answer: Round-trip transaction structuring
Round-trip transactions send funds to a complicit entity and receive them back, creating the appearance of legitimate commerce while obscuring the original source.
Question 2: Which nonce characteristic in an Ethereum account would alert a CCA auditor to a potential transaction gap or out-of-order submission?
- A nonce value of zero
- A nonce sequence with a missing integer (e.g., nonces 1, 2, 4 with no nonce 3) (Correct answer)
- A nonce greater than 100
- A nonce that matches the block number
Correct answer: A nonce sequence with a missing integer (e.g., nonces 1, 2, 4 with no nonce 3)
Ethereum enforces sequential nonce ordering; a gap in nonces indicates a pending or dropped transaction that may have moved funds not yet visible on-chain.
Question 3: What is the primary audit purpose of analyzing the 'change output' in a Bitcoin transaction?
- Verifying miner fee calculation
- Identifying the likely wallet address controlled by the transaction sender (Correct answer)
- Confirming transaction finality
- Measuring network congestion
Correct answer: Identifying the likely wallet address controlled by the transaction sender
The change output returns unspent funds to the sender's own wallet, and identifying it helps auditors separate recipient addresses from the sender's address cluster.
Question 4: When auditing a Proof-of-Stake validator, which on-chain data source reveals whether the validator engaged in slashable double-signing behavior?
- The validator's withdrawal credentials
- Slashing events recorded in the beacon chain or consensus layer (Correct answer)
- The validator's balance history
- The gas fees collected by the validator
Correct answer: Slashing events recorded in the beacon chain or consensus layer
Slashing events are explicitly recorded in the consensus layer (e.g., Ethereum beacon chain) and indicate that a validator signed two conflicting blocks or attestations.
Question 5: A CCA auditor is reviewing a stablecoin issuer. Which audit procedure best verifies that the stablecoin supply matches the underlying reserve assets?
- Reviewing the issuer's website disclosures
- Reconciling on-chain total token supply against independently verified reserve attestation reports (Correct answer)
- Checking the token contract's metadata
- Reviewing the issuer's social media announcements
Correct answer: Reconciling on-chain total token supply against independently verified reserve attestation reports
Reconciling the on-chain minted supply against third-party attested reserves is the only procedure that links blockchain data to real-world backing.
Question 6: Which of the following best describes a 'layering' stage red flag specific to cryptocurrency transactions?
- A large initial deposit from an unknown source
- Rapid sequential transfers through multiple wallets or exchanges across different blockchains with no apparent business purpose (Correct answer)
- A single large withdrawal to a bank account
- Holding cryptocurrency in cold storage for an extended period
Correct answer: Rapid sequential transfers through multiple wallets or exchanges across different blockchains with no apparent business purpose
Rapid multi-hop transfers across wallets and chains with no economic rationale are a classic layering technique to distance funds from their illicit origin.
Question 7: What does a high 'realized cap' relative to 'market cap' in a cryptocurrency suggest from an audit perspective?
- The asset is heavily shorted
- Most coins were last moved at prices close to or above current market price, indicating limited paper gains (Correct answer)
- The network has low transaction volume
- The asset has significant unrealized losses across holders
Correct answer: Most coins were last moved at prices close to or above current market price, indicating limited paper gains
When realized cap approaches market cap, it means coins were acquired at prices near current levels, suggesting limited speculative bubble dynamics at the population level.
CCA Cryptocurrency Transaction Auditing 3
A suspicious transaction sends funds to a known darknet market address, then receives funds back after a delay.
What technique is this most consistent with?