NICK FURNEAUX is a cybersecurity and forensics consultant specializing in the prevention and investigation of cybercrime. Nick is author of the 2018 book Investigating Cryptocurrencies and has trained thousands of investigators in the skills needed to track cryptocurrency used in crimes. He works within the training academy at TRM Labs, and is an advisor to the Board of Asset Reality.

Foreword xiii

Introduction xvii

1 A History of Cryptocurrencies and Crime 1

Where Did It All Start? 3

The Rise of the Smart Contract 7

The Next Targets? 14

The Future? More Crime! 16

2 Understanding the Criminal Opportunities: Money Laundering 19

There Is No Such Thing as Crypto Crime 36

Money Laundering 40

What Is an Investigator Looking For? 42

Centralized Exchanges 43

NFTs and NFT Gaming 45

Mixers 48

Decentralized Exchanges 53

Casinos. 56

Chain Hopping 57

Privacy Coins 59

Crypto ATMs 62

Peer-to-Peer Platforms 64

3 Understanding the Criminal Opportunities: Theft 67

Crypto Thefts 67

Social Engineering 67

Phishing 68

Hacks 71

Fraud 73

Rug Pull 74

Pig-Butchering/Romance Scams 76

Investment Scams 79

Support Scams 83

Simple Theft 84

Contract Manipulation 86

Fake Contracts 86

Exploiting the Contract 87

Phishing 89

Flash Loans 90

Playing by the Rules 92

Other Criminal Opportunities 96

Yield Farming 96

Funding of Groups 97

Sanctions Avoidance 99

Summary 108

4 Who Should Be a Cryptocurrency Investigator? 109

Individual Skills 111

Knowledge of Technological Systems 111

Knowledge of Digital Currencies 112

Understanding of the Cryptocurrency Market 112

Extensive Knowledge of Computer Networks 113

Cryptography 114

Financial Crime 114

Fraud Investigators 114

Open Source Investigations 115

Cybercrime Investigations 116

Setting Up a Cryptocurrency Investigation Department 117

Other Roles. 123

5 The Role of Commercial Investigation Tools 125

Do You Need a Commercial Tool? 129

Two Is One and One Is None 133

The Future of Investigation Tools 135

6 Mining: The Key to Cryptocurrencies 139

What Really Is Mining? 141

Validating Transactions 141

Minting New Coins 142

Proof of Work (PoW) Mining 142

How PoW Mining Works 142

Energy Consumption and Environmental Concerns 145

Proof of Stake (PoS) Mining 146

How PoS Mining Works 146

Advantages of PoS Mining 146

Does an Investigator Need to Understand Mining Technologies? 146

Cryptocurrency Mining Frauds and Scams 147

Cloud Mining Scams 147

Ponzi and Pyramid Schemes 148

Malware and Cryptojacking 149

Asset Discovery 149

Will Cryptocurrencies Always Be Mined? 150

7 Cryptocurrency Wallets 153

When a Wallet Is Not Really a Wallet 155

Types of Cryptocurrency Wallets 156

Hot Wallets 157

Desktop Wallets. 157

Mobile Wallets 158

Web/Online Wallets 158

Cold Wallets 160

Hardware Wallets 160

Paper Wallets 161

Software Wallets: Functionality and Security 162

Functionality 163

Security 163

Hardware Wallets: Functionality and Security 164

Functionality 164

Security 164

Choosing the Right Wallet 165

Wallet Vulnerabilities 166

Weak or Reused Passwords 166

Phishing Attacks 166

Malware 167

On-Path Attacks 167

Vulnerable Wallet Software 168

Lack of Two-Factor Authentication (2FA) 168

Social Engineering 169

SIM-Swapping Attacks 169

Supply Chain Attacks 170

8 The Importance of Discovery 173

Premises Searching: Legal Framework and Search Powers 176

Search Strategies 177

Handling and Securing Evidence 177

Evidence Bags 178

Body Cameras 179

Photography 179

Chain of Custody 180

Physical Clues. 181

Hardware Wallets 181

Paper Wallets 183

QR Codes 186

Documentation 186

Questioning 188

General Understanding 188

Involvement and Knowledge of Cryptocurrencies 188

Specific Details of the Alleged Crime 189

Technical Details 189

Searching Digital Assets 190

Legal Framework and Warrants 192

Digital Forensics 194

Hardware Examination 198

Storage Devices 198

RAM Analysis 200

What are you looking for? 202

Handling and Securing Digital Evidence 204

The Role of Exchanges 204

Senior Officers/Management 206

Summary 206

9 The Workings of Bitcoin and Derivatives 209

Bitcoin Is a Blockchain-Based UTXO Cryptocurrency 210

UTXO 211

What Does an Transaction Look Like? 215

How Does a UTXO Blockchain Help an Investigator? 220

Blockchain Explorers 222

What Else Can You Learn in a Transaction? 226

Times and Dates 227

Values 229

Omni Layer 231

Taproot 232

The Lightning Network 235

Summary 237

10 Bitcoin: Investigation Methodology 239

Building an Investigation in Bitcoin 251

Address Clustering 253

How Are Clusters Defined? 255

Co-spend Heuristic 255

Change Analysis 256

Nominal Spend 257

Address Type Analysis 259

Multisig Analysis 260

Round Number Payments 261

Some Other Things to Note 262

Change of Ownership 263

Change of Wallet 263

Look at the Amounts 263

Address Triage 265

Attribution 271

Investigating Bitcoin 271

11 The Workings of Ethereum and Derivatives 273

History of the Ethereum Cryptocurrency 274

Ethereum Fundamentals 276

Types of Tokens 279

Ethereum Transaction Types 282

One Address for All Tokens 286

A User's Address Can Be the Same on Other Blockchains 288

Reading Basic Transactions 290

Transaction Methods 291

Transaction and Address Types 293

What Are These Contracts We Keep Mentioning? 294

Identifying Contract Transactions 295

Conclusion 296

12 Ethereum: Investigation Methodology 297

Following ETH-to-ETH Transactions 297

Smart Contracts Deep Dive 304

Methods, Functions, and Events 307

Code 309

Read Contract 310

Write Contract. 310

Logs 314

ETH-to-Contract Transactions 316

Token-to-Token Transactions 324

NFTs 329

Decentralized Exchanges 335

Reading Decentralized Finance Contracts 342

The Approve Transaction 351

Summary 353

13 Investigating Binance Smart Chain 355

What is Binance Smart Chain? 355

Investigating Funds on Binance Smart Chain 357

What Have You Learned? 364

14 Applying What You Have Learned to New Cryptocurrencies 367

Stable Coins Such as USDT, USDC, and Paxos 368

Tron 372

Tron Fee Structure 372

What Transactions Look Like 372

Layer 2 Chains 377

Bridges 383

Mixers 388

Bitcoin Mixing 389

Ethereum Mixing 393

Privacy Coins 395

Monero (XMR): The Vanguard of Privacy Coins 396

Zcash (ZEC): Selective Transparency 396

Dash (DASH): Privacy as an Option 397

Horizen (ZEN): Extended Privacy with Sidechains 397

Grin and Beam: Mimblewimble Protocol 398

What Have You Learned? 398

15 Open Source Intelligence and the Blockchain 401

Mindset 402

Just "Search Engine" It 404

Attribution of Individuals 412

NFT Metadata 421

OSINT and the Dark Web 423

Summary 425

16 Using Wallets for Investigations 427

Understanding Cryptocurrency Wallets 427

Seed Words and Wallet Recovery 428

Step-by-Step Guide to HD Wallet Re-creation 428

What Can Be Seen? 429

The Benefits of Wallet Re-creation in Investigations 434

Understanding Derivation Paths in Cryptocurrency Wallets 435

The Importance of Understanding Derivation Paths for Investigators 435

Avoiding Oversight and Ensuring Legal Admissibility 436

The Concept of a Derivation Path 436

Bitcoin vs Ethereum Derivation Paths 437

Changing Derivation Paths in Software Wallets 438

To Sum Up 444

17 Crypto Seizure 445

What Do You Need to Carry Out a Crypto Seizure? 463

Recording Seed Words 466

Seizing to Your Own Wallet 467

Considerations for a Software Wallet 467

Considerations for a Hardware Wallet 468

Establishing an Organizational Process 469

Document Your Processes 469

Methods of Recording 470

Paperwork 470

Video 470

Preparation and Administration 471

Documentation in Law Enforcement Systems 471

Questions to Ask before Carrying Out a Crypto Seizure 471

Preparing for a Time-Sensitive Seizure 472

On-Site Seizure Considerations 472

Managing Access and Potential Threats 472

On-Site Toolkit and Practice 473

Where to Store Seized Assets? 473

Seizing to an Exchange 473

Specialist Custodians 474

Seizing to a Law Enforcement-Controlled Wallet 475

Final Thoughts 477

Acknowledgments 483

About the Author 485

About the Contributors 487

About the Technical Editor 493

Index 495