CCI - Certified Cryptocurrency Investigator Blockchain Forensics and Analysis Questions and Answers — Questions and Answers
Question 1: An investigator is analyzing a series of Bitcoin transactions related to a darknet market seizure. They are using a blockchain analysis tool to trace the flow of funds. The investigator groups multiple addresses that are likely controlled by the same entity based on their transactional patterns. What is this specific forensic technique called?
- Address Attribution
- Taint Analysis
- Clustering (Correct answer)
- Smart Contract Analysis
Correct answer: Clustering
Clustering is a core technique in blockchain forensics used to group together multiple addresses that are likely controlled by the same entity. This is achieved by analyzing transaction patterns, such as co-spending of inputs, to deanonymize users and trace the flow of illicit funds. [10, 11]
Question 2: During the execution of a search warrant, a Certified Cryptocurrency Investigator discovers a small, USB-like device. The suspect claims it is a simple storage drive. However, the investigator suspects it is a hardware wallet. Which of the following is the MOST critical piece of information to obtain from the suspect to access the funds associated with this device?
- The public address of the wallet
- The make and model of the device
- The PIN or passphrase for the device (Correct answer)
- A list of recent transaction hashes
Correct answer: The PIN or passphrase for the device
Hardware wallets are physical devices that store private keys offline. [1, 15] To access the wallet and authorize any transactions, an investigator would need the user's PIN, passphrase, or other authentication credentials. While other information is useful, the PIN/passphrase is the key to unlocking the device itself.
Question 3: Which of the following BEST describes the primary function of blockchain analysis platforms like Chainalysis, Elliptic, or TRM Labs in a forensic investigation?
- To seize and secure cryptocurrency from suspect wallets.
- To provide real-time risk scoring and trace the flow of funds across blockchains. [2] (Correct answer)
- To execute smart contracts for recovering stolen assets.
- To create new cryptocurrency wallets for undercover operations.
Correct answer: To provide real-time risk scoring and trace the flow of funds across blockchains. [2]
Blockchain analysis platforms are specialized tools designed to de-anonymize transactions. Their primary function is to analyze blockchain data, trace the movement of funds, identify links between addresses and real-world entities, and provide risk scores for transactions associated with illicit activities like darknet markets or sanctioned addresses. [2, 6, 7]
Question 4: An investigator is examining the key differences between how Bitcoin and Ethereum record transactions for a fraud case. They note that Bitcoin transactions involve consuming previous outputs to create new ones, making it resemble a cash transaction. What is this model called?
- Proof-of-Stake Model
- Account-Based Model
- State Channel Model
- Unspent Transaction Output (UTXO) Model (Correct answer)
Correct answer: Unspent Transaction Output (UTXO) Model
The Unspent Transaction Output (UTXO) model is used by Bitcoin. [22, 29, 30] In this model, transactions consume UTXOs from previous transactions and generate new UTXOs as outputs. This is distinct from the account-based model used by Ethereum, which maintains balances in accounts, similar to a bank ledger. [22, 28]
Question 5: A Certified Cryptocurrency Investigator is presenting evidence in a money laundering case. They need to explain how the suspect attempted to obscure the trail of stolen funds. The suspect sent their cryptocurrency to a service that pooled their funds with those of many other users before distributing them to new, clean addresses. What is this anonymization technique known as?
- Mixing (or Tumbling) (Correct answer)
- Chain Hopping
- Forking
- Airdropping
Correct answer: Mixing (or Tumbling)
Mixing, also known as tumbling, is a service that breaks the link between a sender and receiver by pooling transactions from multiple users and redistributing them. This makes it difficult for blockchain analysis tools to trace the original source of the funds, thereby enhancing anonymity. [17, 19]
Question 6: While examining a suspect's laptop, an investigator finds a text file containing a list of 24 random words. The investigator immediately recognizes this as a potentially critical piece of evidence. What is the most likely function of this list of words in the context of a cryptocurrency investigation?
- A password list for various online exchanges.
- A list of usernames for darknet market accounts.
- A seed phrase used to restore a cryptocurrency wallet. [3, 4] (Correct answer)
- A brain wallet encryption key.
Correct answer: A seed phrase used to restore a cryptocurrency wallet. [3, 4]
A seed phrase, or recovery phrase, is a list of 12 to 24 words that can be used to regenerate an entire cryptocurrency wallet, providing full access to the funds within it. [3] Finding a seed phrase is a critical discovery as it is equivalent to possessing the assets themselves. [1]
CCI - Certified Cryptocurrency Investigator Blockchain Forensics and Analysis Questions and Answers
An investigator is analyzing a series of Bitcoin transactions related to a darknet market seizure.
They are using a blockchain analysis tool to trace the flow of funds.
The investigator groups multiple addresses that are likely controlled by the same entity based on their transactional patterns.
What is this specific forensic technique called?