CCI - Certified Cryptocurrency Investigator Crypto Investigation Techniques Questions and Answers

Question 1

An investigator obtains transaction records from a major centralized exchange.
The records show a suspect frequently traded large amounts of ETH for USDT and back again within a single day.
However, a review of the suspect's known Ethereum deposit address on a public blockchain explorer shows no corresponding on-chain transactions for these trades.
What is the most likely explanation for this discrepancy?

Accepted Answer

The trades were executed off-chain on the exchange's internal ledger.

Answer

The blockchain explorer is experiencing a significant data lag.

Answer

The suspect was using a DeFi protocol through a wallet linked to the exchange.

Answer

The exchange automatically mixed the transactions, obscuring them from public view.

Question 2

While analyzing a major DeFi exploit on the Ethereum blockchain, an investigator observes the attacker's transaction. It shows that the attacker's malicious smart contract called the 'withdraw' function on the victim's protocol. Before the victim's protocol could update the attacker's balance, the attacker's contract repeatedly called the 'withdraw' function again within the same transaction, draining the protocol's funds. This vulnerability is best described as what type of attack?

Accepted Answer

A reentrancy attack

Answer

A 51% attack

Answer

A Sybil attack

Answer

A flash loan attack

Question 3

During a digital forensic examination of a suspect's computer running Windows, an investigator is searching for evidence of a Bitcoin Core software wallet. Which of the following files, typically found in the AppData\Roaming\Bitcoin directory, is the most critical artifact to secure as it contains the wallet's private keys?

Accepted Answer

wallet.dat

Answer

peers.dat

Answer

debug.log

Answer

mempool.dat

Question 4

Which of the following money laundering techniques is defined by the use of cross-chain bridges or decentralized services to move illicit funds from one blockchain to another (e.g., from Bitcoin to Ethereum to Monero) in an attempt to break the forensic trail?

Accepted Answer

Chain hopping

Answer

Address clustering

Answer

Peeling

Answer

Mixing

Question 5

A Virtual Asset Service Provider (VASP) is obligated under the BSA's 'Travel Rule' to collect, retain, and transmit specific information about fund transfers to the next financial institution. What is the primary purpose of this regulation in the context of a crypto investigation?

Accepted Answer

To create an information trail and prevent gaps in transaction data that could be exploited for money laundering.

Answer

To ensure VASPs maintain adequate crypto reserves for customer withdrawals.

Answer

To standardize transaction fees across different exchanges and services.

Answer

To provide a public record of all VASP-to-VASP transactions for market analysis.

Question 6

An investigator has successfully identified the public IP address of a full node suspected of broadcasting illicit transactions on the Bitcoin network. Which of the following investigative steps would be the MOST direct method to determine the probable physical location of this node?

Accepted Answer

Using a commercial IP geolocation database or service.

Answer

Submitting a subpoena to the Bitcoin Foundation for user records.

Answer

Analyzing the timestamps of the node's transactions to infer a time zone.

Answer

Tracing the flow of transaction fees paid by the node.