CCI - Certified Cryptocurrency Investigator Crypto Investigation Techniques Questions and Answers — Questions and Answers
Question 1: An investigator obtains transaction records from a major centralized exchange. The records show a suspect frequently traded large amounts of ETH for USDT and back again within a single day. However, a review of the suspect's known Ethereum deposit address on a public blockchain explorer shows no corresponding on-chain transactions for these trades. What is the most likely explanation for this discrepancy?
- The blockchain explorer is experiencing a significant data lag.
- The suspect was using a DeFi protocol through a wallet linked to the exchange.
- The trades were executed off-chain on the exchange's internal ledger. (Correct answer)
- The exchange automatically mixed the transactions, obscuring them from public view.
Correct answer: The trades were executed off-chain on the exchange's internal ledger.
Centralized exchanges (CEXs) typically record trades between users on their own private, internal ledgers (off-chain). This allows for high-speed, low-cost trading. An on-chain transaction only occurs when a user deposits funds to the exchange or withdraws funds from it. Therefore, the absence of these trades on the public blockchain is expected behavior.
Question 2: While analyzing a major DeFi exploit on the Ethereum blockchain, an investigator observes the attacker's transaction. It shows that the attacker's malicious smart contract called the 'withdraw' function on the victim's protocol. Before the victim's protocol could update the attacker's balance, the attacker's contract repeatedly called the 'withdraw' function again within the same transaction, draining the protocol's funds. This vulnerability is best described as what type of attack?
- A 51% attack
- A reentrancy attack (Correct answer)
- A Sybil attack
- A flash loan attack
Correct answer: A reentrancy attack
A reentrancy attack occurs when a function in a smart contract makes an external call to another untrusted contract before it resolves any effects on its own state. This allows the untrusted contract to call back into the original function multiple times before the initial invocation is complete, leading to exploits like draining funds, as described in the scenario.
Question 3: During a digital forensic examination of a suspect's computer running Windows, an investigator is searching for evidence of a Bitcoin Core software wallet. Which of the following files, typically found in the AppData\Roaming\Bitcoin directory, is the most critical artifact to secure as it contains the wallet's private keys?
- peers.dat
- debug.log
- mempool.dat
- wallet.dat (Correct answer)
Correct answer: wallet.dat
The wallet.dat file is the most critical file for a Bitcoin Core client. It contains the user's private keys, public keys, addresses, and transaction records. Securing this file (and the passphrase to unlock it) gives an investigator control over the cryptocurrency funds associated with that wallet.
Question 4: Which of the following money laundering techniques is defined by the use of cross-chain bridges or decentralized services to move illicit funds from one blockchain to another (e.g., from Bitcoin to Ethereum to Monero) in an attempt to break the forensic trail?
- Chain hopping (Correct answer)
- Address clustering
- Peeling
- Mixing
Correct answer: Chain hopping
Chain hopping is the specific term for moving crypto assets between different blockchains to obscure their origin and path. This is distinct from mixing or tumbling, which typically anonymizes transactions within the same blockchain. Chain hopping exploits the disconnected nature of different ledgers to make tracing more difficult for investigators.
Question 5: A Virtual Asset Service Provider (VASP) is obligated under the BSA's 'Travel Rule' to collect, retain, and transmit specific information about fund transfers to the next financial institution. What is the primary purpose of this regulation in the context of a crypto investigation?
- To ensure VASPs maintain adequate crypto reserves for customer withdrawals.
- To standardize transaction fees across different exchanges and services.
- To create an information trail and prevent gaps in transaction data that could be exploited for money laundering. (Correct answer)
- To provide a public record of all VASP-to-VASP transactions for market analysis.
Correct answer: To create an information trail and prevent gaps in transaction data that could be exploited for money laundering.
The primary purpose of the Travel Rule, as enforced by FinCEN, is to preserve an information trail for fund transfers between financial institutions (including VASPs). This ensures that law enforcement can follow the flow of funds and have access to originator and beneficiary information, which is critical for investigating money laundering, terrorist financing, and other financial crimes.
Question 6: An investigator has successfully identified the public IP address of a full node suspected of broadcasting illicit transactions on the Bitcoin network. Which of the following investigative steps would be the MOST direct method to determine the probable physical location of this node?
- Submitting a subpoena to the Bitcoin Foundation for user records.
- Analyzing the timestamps of the node's transactions to infer a time zone.
- Using a commercial IP geolocation database or service. (Correct answer)
- Tracing the flow of transaction fees paid by the node.
Correct answer: Using a commercial IP geolocation database or service.
IP geolocation services and databases correlate IP addresses with real-world geographic locations. While not always perfectly precise and subject to obfuscation by VPNs or Tor, querying the suspect IP address against these databases is the most direct and common first step to ascertain the likely country, city, and ISP associated with the node.
CCI - Certified Cryptocurrency Investigator Crypto Investigation Techniques Questions and Answers
An investigator obtains transaction records from a major centralized exchange.
The records show a suspect frequently traded large amounts of ETH for USDT and back again within a single day.
However, a review of the suspect's known Ethereum deposit address on a public blockchain explorer shows no corresponding on-chain transactions for these trades.
What is the most likely explanation for this discrepancy?