Foreword xiii
Introduction xvii
1 A History of Cryptocurrencies and Crime 1
Where Did It All Start? 3
The Rise of the Smart Contract 7
The Next Targets? 14
The Future? More Crime! 16
2 Understanding the Criminal Opportunities: Money Laundering 19
There Is No Such Thing as Crypto Crime 36
Money Laundering 40
What Is an Investigator Looking For? 42
Centralized Exchanges 43
NFTs and NFT Gaming 45
Mixers 48
Decentralized Exchanges 53
Casinos. 56
Chain Hopping 57
Privacy Coins 59
Crypto ATMs 62
Peer-to-Peer Platforms 64
3 Understanding the Criminal Opportunities: Theft 67
Crypto Thefts 67
Social Engineering 67
Phishing 68
Hacks 71
Fraud 73
Rug Pull 74
Pig-Butchering/Romance Scams 76
Investment Scams 79
Support Scams 83
Simple Theft 84
Contract Manipulation 86
Fake Contracts 86
Exploiting the Contract 87
Phishing 89
Flash Loans 90
Playing by the Rules 92
Other Criminal Opportunities 96
Yield Farming 96
Funding of Groups 97
Sanctions Avoidance 99
Summary 108
4 Who Should Be a Cryptocurrency Investigator? 109
Individual Skills 111
Knowledge of Technological Systems 111
Knowledge of Digital Currencies 112
Understanding of the Cryptocurrency Market 112
Extensive Knowledge of Computer Networks 113
Cryptography 114
Financial Crime 114
Fraud Investigators 114
Open Source Investigations 115
Cybercrime Investigations 116
Setting Up a Cryptocurrency Investigation Department 117
Other Roles. 123
5 The Role of Commercial Investigation Tools 125
Do You Need a Commercial Tool? 129
Two Is One and One Is None 133
The Future of Investigation Tools 135
6 Mining: The Key to Cryptocurrencies 139
What Really Is Mining? 141
Validating Transactions 141
Minting New Coins 142
Proof of Work (PoW) Mining 142
How PoW Mining Works 142
Energy Consumption and Environmental Concerns 145
Proof of Stake (PoS) Mining 146
How PoS Mining Works 146
Advantages of PoS Mining 146
Does an Investigator Need to Understand Mining Technologies? 146
Cryptocurrency Mining Frauds and Scams 147
Cloud Mining Scams 147
Ponzi and Pyramid Schemes 148
Malware and Cryptojacking 149
Asset Discovery 149
Will Cryptocurrencies Always Be Mined? 150
7 Cryptocurrency Wallets 153
When a Wallet Is Not Really a Wallet 155
Types of Cryptocurrency Wallets 156
Hot Wallets 157
Desktop Wallets. 157
Mobile Wallets 158
Web/Online Wallets 158
Cold Wallets 160
Hardware Wallets 160
Paper Wallets 161
Software Wallets: Functionality and Security 162
Functionality 163
Security 163
Hardware Wallets: Functionality and Security 164
Functionality 164
Security 164
Choosing the Right Wallet 165
Wallet Vulnerabilities 166
Weak or Reused Passwords 166
Phishing Attacks 166
Malware 167
On-Path Attacks 167
Vulnerable Wallet Software 168
Lack of Two-Factor Authentication (2FA) 168
Social Engineering 169
SIM-Swapping Attacks 169
Supply Chain Attacks 170
8 The Importance of Discovery 173
Premises Searching: Legal Framework and Search Powers 176
Search Strategies 177
Handling and Securing Evidence 177
Evidence Bags 178
Body Cameras 179
Photography 179
Chain of Custody 180
Physical Clues. 181
Hardware Wallets 181
Paper Wallets 183
QR Codes 186
Documentation 186
Questioning 188
General Understanding 188
Involvement and Knowledge of Cryptocurrencies 188
Specific Details of the Alleged Crime 189
Technical Details 189
Searching Digital Assets 190
Legal Framework and Warrants 192
Digital Forensics 194
Hardware Examination 198
Storage Devices 198
RAM Analysis 200
What are you looking for? 202
Handling and Securing Digital Evidence 204
The Role of Exchanges 204
Senior Officers/Management 206
Summary 206
9 The Workings of Bitcoin and Derivatives 209
Bitcoin Is a Blockchain-Based UTXO Cryptocurrency 210
UTXO 211
What Does an Transaction Look Like? 215
How Does a UTXO Blockchain Help an Investigator? 220
Blockchain Explorers 222
What Else Can You Learn in a Transaction? 226
Times and Dates 227
Values 229
Omni Layer 231
Taproot 232
The Lightning Network 235
Summary 237
10 Bitcoin: Investigation Methodology 239
Building an Investigation in Bitcoin 251
Address Clustering 253
How Are Clusters Defined? 255
Co-spend Heuristic 255
Change Analysis 256
Nominal Spend 257
Address Type Analysis 259
Multisig Analysis 260
Round Number Payments 261
Some Other Things to Note 262
Change of Ownership 263
Change of Wallet 263
Look at the Amounts 263
Address Triage 265
Attribution 271
Investigating Bitcoin 271
11 The Workings of Ethereum and Derivatives 273
History of the Ethereum Cryptocurrency 274
Ethereum Fundamentals 276
Types of Tokens 279
Ethereum Transaction Types 282
One Address for All Tokens 286
A User’s Address Can Be the Same on Other Blockchains 288
Reading Basic Transactions 290
Transaction Methods 291
Transaction and Address Types 293
What Are These Contracts We Keep Mentioning? 294
Identifying Contract Transactions 295
Conclusion 296
12 Ethereum: Investigation Methodology 297
Following ETH-to-ETH Transactions 297
Smart Contracts Deep Dive 304
Methods, Functions, and Events 307
Code 309
Read Contract 310
Write Contract. 310
Logs 314
ETH-to-Contract Transactions 316
Token-to-Token Transactions 324
NFTs 329
Decentralized Exchanges 335
Reading Decentralized Finance Contracts 342
The Approve Transaction 351
Summary 353
13 Investigating Binance Smart Chain 355
What is Binance Smart Chain? 355
Investigating Funds on Binance Smart Chain 357
What Have You Learned? 364
14 Applying What You Have Learned to New Cryptocurrencies 367
Stable Coins Such as USDT, USDC, and Paxos 368
Tron 372
Tron Fee Structure 372
What Transactions Look Like 372
Layer 2 Chains 377
Bridges 383
Mixers 388
Bitcoin Mixing 389
Ethereum Mixing 393
Privacy Coins 395
Monero (XMR): The Vanguard of Privacy Coins 396
Zcash (ZEC): Selective Transparency 396
Dash (DASH): Privacy as an Option 397
Horizen (ZEN): Extended Privacy with Sidechains 397
Grin and Beam: Mimblewimble Protocol 398
What Have You Learned? 398
15 Open Source Intelligence and the Blockchain 401
Mindset 402
Just “Search Engine” It 404
Attribution of Individuals 412
NFT Metadata 421
OSINT and the Dark Web 423
Summary 425
16 Using Wallets for Investigations 427
Understanding Cryptocurrency Wallets 427
Seed Words and Wallet Recovery 428
Step-by-Step Guide to HD Wallet Re-creation 428
What Can Be Seen? 429
The Benefits of Wallet Re-creation in Investigations 434
Understanding Derivation Paths in Cryptocurrency Wallets 435
The Importance of Understanding Derivation Paths for Investigators 435
Avoiding Oversight and Ensuring Legal Admissibility 436
The Concept of a Derivation Path 436
Bitcoin vs Ethereum Derivation Paths 437
Changing Derivation Paths in Software Wallets 438
To Sum Up 444
17 Crypto Seizure 445
What Do You Need to Carry Out a Crypto Seizure? 463
Recording Seed Words 466
Seizing to Your Own Wallet 467
Considerations for a Software Wallet 467
Considerations for a Hardware Wallet 468
Establishing an Organizational Process 469
Document Your Processes 469
Methods of Recording 470
Paperwork 470
Video 470
Preparation and Administration 471
Documentation in Law Enforcement Systems 471
Questions to Ask before Carrying Out a Crypto Seizure 471
Preparing for a Time-Sensitive Seizure 472
On-Site Seizure Considerations 472
Managing Access and Potential Threats 472
On-Site Toolkit and Practice 473
Where to Store Seized Assets? 473
Seizing to an Exchange 473
Specialist Custodians 474
Seizing to a Law Enforcement–Controlled Wallet 475
Final Thoughts 477
Acknowledgments 483
About the Author 485
About the Contributors 487
About the Technical Editor 493
Index 495
