Blockchain Forensic Analysis Flashcards

What is 'address poisoning' in the context of cryptocurrency fraud investigation?

Answer: Creating a lookalike address with matching first/last characters to trick victims into sending funds to the wrong address

Address poisoning exploits copy-paste behavior by sending zero-value transactions from a vanity address that visually resembles the victim's counterparty address.

In UTXO-based chain analysis, which output type is most commonly identified as a 'change output' returned to the sender?

Answer: The output with a non-round amount sent to a previously unused address

Change outputs typically carry the residual non-round amount and are sent to a fresh address generated by the sender's wallet, distinguishing them from the payment output.

Which technique do forensic analysts use to attribute blockchain addresses to real-world entities without a legal request to an exchange?

Answer: Open-source intelligence (OSINT) combined with direct interaction transactions

OSINT (forums, social media, dark web markets) combined with controlled test transactions that interact with suspect addresses can attribute wallets to entities outside of formal legal process.

A forensic report shows a wallet cluster sending funds through five intermediate hops before reaching a known exchange. This pattern most closely describes which stage of money laundering?

Answer: Layering

Layering involves moving funds through multiple transactions or intermediaries to obscure the audit trail and distance proceeds from their criminal origin.

Which property of a public blockchain makes it fundamentally different from traditional financial records for forensic purposes?

Answer: Blockchain records are immutable and permanently accessible without a court order

Public blockchains are permissionless ledgers where all historical data is permanently transparent, giving investigators indefinite access without needing to subpoena a custodian.

What is the forensic significance of an 'unspent transaction output' (UTXO) that has never moved since being created three years ago?

Answer: It indicates the private key is lost or the holder is a long-term holder (HODLer), and is typically excluded from active investigation

Long-dormant UTXOs may represent lost wallets, deceased holders, or deliberate holding strategies, and analysts must assess context before attributing intent.

Which standard framework do U.S. federal agencies typically reference when conducting cryptocurrency tracing investigations and preparing court-admissible reports?

Answer: FinCEN's BSA/AML examination manual supplemented by agency-specific SOPs

U.S. agencies rely on FinCEN's BSA/AML framework and agency-specific standard operating procedures to ensure findings meet evidentiary standards in federal proceedings.