Mixed Deck — All CCI Topics Flashcards

What is the investigative significance of IP log records obtained from a cryptocurrency exchange?

Answer: They can reveal the true geographic location of account users, helping physically identify and locate perpetrators

IP log records reveal the geographic origin of account logins, allowing investigators to determine where account users are actually located and potentially identify them.

While analyzing a major DeFi exploit on the Ethereum blockchain, an investigator observes the attacker's transaction. It shows that the attacker's malicious smart contract called the 'withdraw' function on the victim's protocol. Before the victim's protocol could update the attacker's balance, the attacker's contract repeatedly called the 'withdraw' function again within the same transaction, draining the protocol's funds. This vulnerability is best described as what type of attack?

Answer: A reentrancy attack

A reentrancy attack occurs when a function in a smart contract makes an external call to another untrusted contract before it resolves any effects on its own state. This allows the untrusted contract to call back into the original function multiple times before the initial invocation is complete, leading to exploits like draining funds, as described in the scenario.

What is a multi-signature (multisig) wallet and how does it complicate cryptocurrency seizure?

Answer: A wallet requiring multiple private keys to authorize transactions; seizure requires obtaining all required keys from potentially different parties

A multisig wallet requires M-of-N private keys to authorize any transaction, meaning investigators must obtain all required keys — often held by different individuals — to move the funds.

While examining a suspect's laptop, an investigator finds a text file containing a list of 24 random words. The investigator immediately recognizes this as a potentially critical piece of evidence. What is the most likely function of this list of words in the context of a cryptocurrency investigation?

Answer: A seed phrase used to restore a cryptocurrency wallet. [3, 4]

A seed phrase, or recovery phrase, is a list of 12 to 24 words that can be used to regenerate an entire cryptocurrency wallet, providing full access to the funds within it. [3] Finding a seed phrase is a critical discovery as it is equivalent to possessing the assets themselves. [1]

A smaller, less-established Proof-of-Work (PoW) altcoin has experienced a sudden and significant reorganization of its blockchain, resulting in reversed transactions. This has allowed an attacker to double-spend a large amount of the altcoin. What type of attack has most likely occurred?

Answer: A 51% attack

A 51% attack occurs when a single entity or group gains control of more than 50% of a blockchain network's mining hash rate. This majority control allows them to manipulate the blockchain, including preventing new transactions, halting payments, and, most notably, reversing their own transactions to double-spend coins. Smaller PoW blockchains are more vulnerable due to the lower hash rate required to achieve a majority.

A Virtual Asset Service Provider (VASP) is obligated under the BSA's 'Travel Rule' to collect, retain, and transmit specific information about fund transfers to the next financial institution. What is the primary purpose of this regulation in the context of a crypto investigation?

Answer: To create an information trail and prevent gaps in transaction data that could be exploited for money laundering.

The primary purpose of the Travel Rule, as enforced by FinCEN, is to preserve an information trail for fund transfers between financial institutions (including VASPs). This ensures that law enforcement can follow the flow of funds and have access to originator and beneficiary information, which is critical for investigating money laundering, terrorist financing, and other financial crimes.

Which type of transaction complicates tracing efforts?

Answer: Mixer or tumbler transactions

Mixer or tumbler services are designed to obscure the origin and destination of cryptocurrency funds by pooling and mixing transactions from multiple users. This process deliberately breaks the direct link between sender and receiver, making it significantly more difficult for investigators to trace the flow of funds and identify the parties involved. They are often used to enhance privacy or for illicit purposes.

A criminal organization attempts to disrupt the Bitcoin network by controlling over half of the network's mining power. They successfully reverse their own recent transactions, effectively spending the same bitcoins twice. What is this type of attack called?

Answer: A 51% Attack

A 51% attack occurs when a single entity or group controls more than 50% of a blockchain network's total mining hashrate. This majority control allows them to manipulate the blockchain, prevent new transactions from gaining confirmations, and reverse their own transactions, leading to double-spending.

When law enforcement seizes cryptocurrency held on a centralized exchange, what is the typical process?

Answer: Serving the exchange with a seizure warrant and directing the exchange to transfer funds to a government-controlled wallet

Law enforcement typically serves the exchange with a seizure warrant, and the exchange then transfers the specified funds to a government-controlled cryptocurrency wallet.

What is a blockchain bridge and why is it significant for cryptocurrency investigations?

Answer: A protocol enabling asset transfers between different blockchains, creating cross-chain tracing gaps

Blockchain bridges enable asset transfers between different blockchain networks, creating investigative challenges because funds effectively disappear on one chain and reappear on another with a different transaction history.

Under the Bank Secrecy Act (BSA), what cash transaction amount triggers a mandatory Currency Transaction Report (CTR)?

Answer: Transactions exceeding $10,000 in a single day

The BSA requires financial institutions to file a Currency Transaction Report (CTR) for any cash transaction exceeding $10,000 in a single business day.

When law enforcement seizes a cryptocurrency hardware wallet but does not know the PIN, what legal options exist?

Answer: Seeking a court order compelling the suspect to disclose the PIN or using authorized forensic techniques to extract it

Investigators may pursue compelled disclosure orders through the courts or employ authorized forensic techniques to extract the PIN, subject to applicable constitutional constraints.

What should an investigator do after tracing funds to an exchange?

Answer: Submit a subpoena or request to the exchange

Once funds are traced to a cryptocurrency exchange, the next crucial step for an investigator is to submit a legal request, such as a subpoena or an information request, to that exchange. This action compels the exchange to provide identifying information about the account holder, including KYC data, transaction history, and potentially IP logs, which can link the digital assets to a real-world identity.

Under FinCEN regulations, cryptocurrency exchanges operating in the US are classified as what type of business?

Answer: Money Services Business (MSB)

FinCEN classifies US cryptocurrency exchanges as Money Services Businesses (MSBs), requiring BSA registration and compliance.

What is AML in the context of cryptocurrency?

Answer: Anti-Money Laundering

AML stands for Anti-Money Laundering, a set of regulations and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income. In the context of cryptocurrency, AML compliance requires exchanges and financial institutions to monitor transactions and report suspicious activities to combat financial crimes. This helps to maintain the integrity of the financial system.

When investigating a cryptocurrency exchange, which legal instrument prevents the exchange from alerting the customer that their records are being sought?

Answer: Non-disclosure order (gag order) accompanying the subpoena

A non-disclosure order (gag order) accompanying a subpoena legally prohibits the exchange from notifying the account holder that their records are under investigation.

What does it mean when an exchange describes funds as held in 'cold storage'?

Answer: Funds are kept in offline wallets disconnected from the internet, providing stronger security but less immediate liquidity

Cold storage refers to cryptocurrency held in offline wallets that are never connected to the internet, significantly reducing exposure to hacking while limiting transaction speed.

How can collaboration help in cryptocurrency investigations?

Answer: Enhances success through combined resources

Collaboration is highly beneficial in cryptocurrency investigations due to the global and complex nature of these crimes. By working with other law enforcement agencies, financial institutions, and blockchain analytics firms, investigators can combine expertise, share intelligence, and leverage diverse resources. This collective effort significantly enhances the chances of successfully tracing funds, identifying perpetrators, and bringing them to justice.

A Certified Cryptocurrency Investigator is examining the rewards a miner received for successfully mining a new block. This reward is composed of two distinct components. Which of the following correctly identifies these two components?

Answer: The block subsidy (newly created bitcoin) and the transaction fees from the included transactions.

A miner's reward for successfully adding a new block to the Bitcoin blockchain consists of two parts: the block subsidy, which is a predetermined amount of newly created bitcoin, and the sum of all transaction fees from the transactions included in that block.

Which agency enforces financial crime laws in the U.S.?

Answer: FinCEN

FinCEN, the Financial Crimes Enforcement Network, is a bureau of the U.S. Department of the Treasury. Its primary mission is to safeguard the financial system from illicit use, combat money laundering, and promote national security through the collection, analysis, and dissemination of financial intelligence. FinCEN plays a key role in enforcing financial crime laws, including those related to cryptocurrency.