NICK FURNEAUX is a cybersecurity and forensics consultant specializing in the prevention and investigation of cybercrime. Nick is author of the 2018 book Investigating Cryptocurrencies and has trained thousands of investigators in the skills needed to track cryptocurrency used in crimes. He works within the training academy at TRM Labs, and is an advisor to the Board of Asset Reality.

• Foreword xiiiIntroduction xvii1 A History of Cryptocurrencies and Crime 1Where Did It All Start? 3The Rise of the Smart Contract 7The Next Targets? 14The Future? More Crime! 162 Understanding the Criminal Opportunities: Money Laundering 19There Is No Such Thing as Crypto Crime 36Money Laundering 40What Is an Investigator Looking For? 42Centralized Exchanges 43NFTs and NFT Gaming 45Mixers 48Decentralized Exchanges 53Casinos. 56Chain Hopping 57Privacy Coins 59Crypto ATMs 62Peer-to-Peer Platforms 643 Understanding the Criminal Opportunities: Theft 67Crypto Thefts 67Social Engineering 67Phishing 68Hacks 71Fraud 73Rug Pull 74Pig-Butchering/Romance Scams 76Investment Scams 79Support Scams 83Simple Theft 84Contract Manipulation 86Fake Contracts 86Exploiting the Contract 87Phishing 89Flash Loans 90Playing by the Rules 92Other Criminal Opportunities 96Yield Farming 96Funding of Groups 97Sanctions Avoidance 99Summary 1084 Who Should Be a Cryptocurrency Investigator? 109Individual Skills 111Knowledge of Technological Systems 111Knowledge of Digital Currencies 112Understanding of the Cryptocurrency Market 112Extensive Knowledge of Computer Networks 113Cryptography 114Financial Crime 114Fraud Investigators 114Open Source Investigations 115Cybercrime Investigations 116Setting Up a Cryptocurrency Investigation Department 117Other Roles. 1235 The Role of Commercial Investigation Tools 125Do You Need a Commercial Tool? 129Two Is One and One Is None 133The Future of Investigation Tools 1356 Mining: The Key to Cryptocurrencies 139What Really Is Mining? 141Validating Transactions 141Minting New Coins 142Proof of Work (PoW) Mining 142How PoW Mining Works 142Energy Consumption and Environmental Concerns 145Proof of Stake (PoS) Mining 146How PoS Mining Works 146Advantages of PoS Mining 146Does an Investigator Need to Understand Mining Technologies? 146Cryptocurrency Mining Frauds and Scams 147Cloud Mining Scams 147Ponzi and Pyramid Schemes 148Malware and Cryptojacking 149Asset Discovery 149Will Cryptocurrencies Always Be Mined? 1507 Cryptocurrency Wallets 153When a Wallet Is Not Really a Wallet 155Types of Cryptocurrency Wallets 156Hot Wallets 157Desktop Wallets. 157Mobile Wallets 158Web/Online Wallets 158Cold Wallets 160Hardware Wallets 160Paper Wallets 161Software Wallets: Functionality and Security 162Functionality 163Security 163Hardware Wallets: Functionality and Security 164Functionality 164Security 164Choosing the Right Wallet 165Wallet Vulnerabilities 166Weak or Reused Passwords 166Phishing Attacks 166Malware 167On-Path Attacks 167Vulnerable Wallet Software 168Lack of Two-Factor Authentication (2FA) 168Social Engineering 169SIM-Swapping Attacks 169Supply Chain Attacks 1708 The Importance of Discovery 173Premises Searching: Legal Framework and Search Powers 176Search Strategies 177Handling and Securing Evidence 177Evidence Bags 178Body Cameras 179Photography 179Chain of Custody 180Physical Clues. 181Hardware Wallets 181Paper Wallets 183QR Codes 186Documentation 186Questioning 188General Understanding 188Involvement and Knowledge of Cryptocurrencies 188Specific Details of the Alleged Crime 189Technical Details 189Searching Digital Assets 190Legal Framework and Warrants 192Digital Forensics 194Hardware Examination 198Storage Devices 198RAM Analysis 200What are you looking for? 202Handling and Securing Digital Evidence 204The Role of Exchanges 204Senior Officers/Management 206Summary 2069 The Workings of Bitcoin and Derivatives 209Bitcoin Is a Blockchain-Based UTXO Cryptocurrency 210UTXO 211What Does an Transaction Look Like? 215How Does a UTXO Blockchain Help an Investigator? 220Blockchain Explorers 222What Else Can You Learn in a Transaction? 226Times and Dates 227Values 229Omni Layer 231Taproot 232The Lightning Network 235Summary 23710 Bitcoin: Investigation Methodology 239Building an Investigation in Bitcoin 251Address Clustering 253How Are Clusters Defined? 255Co-spend Heuristic 255Change Analysis 256Nominal Spend 257Address Type Analysis 259Multisig Analysis 260Round Number Payments 261Some Other Things to Note 262Change of Ownership 263Change of Wallet 263Look at the Amounts 263Address Triage 265Attribution 271Investigating Bitcoin 27111 The Workings of Ethereum and Derivatives 273History of the Ethereum Cryptocurrency 274Ethereum Fundamentals 276Types of Tokens 279Ethereum Transaction Types 282One Address for All Tokens 286A User’s Address Can Be the Same on Other Blockchains 288Reading Basic Transactions 290Transaction Methods 291Transaction and Address Types 293What Are These Contracts We Keep Mentioning? 294Identifying Contract Transactions 295Conclusion 29612 Ethereum: Investigation Methodology 297Following ETH-to-ETH Transactions 297Smart Contracts Deep Dive 304Methods, Functions, and Events 307Code 309Read Contract 310Write Contract. 310Logs 314ETH-to-Contract Transactions 316Token-to-Token Transactions 324NFTs 329Decentralized Exchanges 335Reading Decentralized Finance Contracts 342The Approve Transaction 351Summary 35313 Investigating Binance Smart Chain 355What is Binance Smart Chain? 355Investigating Funds on Binance Smart Chain 357What Have You Learned? 36414 Applying What You Have Learned to New Cryptocurrencies 367Stable Coins Such as USDT, USDC, and Paxos 368Tron 372Tron Fee Structure 372What Transactions Look Like 372Layer 2 Chains 377Bridges 383Mixers 388Bitcoin Mixing 389Ethereum Mixing 393Privacy Coins 395Monero (XMR): The Vanguard of Privacy Coins 396Zcash (ZEC): Selective Transparency 396Dash (DASH): Privacy as an Option 397Horizen (ZEN): Extended Privacy with Sidechains 397Grin and Beam: Mimblewimble Protocol 398What Have You Learned? 39815 Open Source Intelligence and the Blockchain 401Mindset 402Just “Search Engine” It 404Attribution of Individuals 412NFT Metadata 421OSINT and the Dark Web 423Summary 42516 Using Wallets for Investigations 427Understanding Cryptocurrency Wallets 427Seed Words and Wallet Recovery 428Step-by-Step Guide to HD Wallet Re-creation 428What Can Be Seen? 429The Benefits of Wallet Re-creation in Investigations 434Understanding Derivation Paths in Cryptocurrency Wallets 435The Importance of Understanding Derivation Paths for Investigators 435Avoiding Oversight and Ensuring Legal Admissibility 436The Concept of a Derivation Path 436Bitcoin vs Ethereum Derivation Paths 437Changing Derivation Paths in Software Wallets 438To Sum Up 44417 Crypto Seizure 445What Do You Need to Carry Out a Crypto Seizure? 463Recording Seed Words 466Seizing to Your Own Wallet 467Considerations for a Software Wallet 467Considerations for a Hardware Wallet 468Establishing an Organizational Process 469Document Your Processes 469Methods of Recording 470Paperwork 470Video 470Preparation and Administration 471Documentation in Law Enforcement Systems 471Questions to Ask before Carrying Out a Crypto Seizure 471Preparing for a Time-Sensitive Seizure 472On-Site Seizure Considerations 472Managing Access and Potential Threats 472On-Site Toolkit and Practice 473Where to Store Seized Assets? 473Seizing to an Exchange 473Specialist Custodians 474Seizing to a Law Enforcement–Controlled Wallet 475Final Thoughts 477Acknowledgments 483About the Author 485About the Contributors 487About the Technical Editor 493Index 495

NICK FURNEAUX is a cybersecurity and forensics consultant specializing in the prevention and investigation of cybercrime. Nick is author of the 2018 book Investigating Cryptocurrencies and has trained thousands of investigators in the skills needed to track cryptocurrency used in crimes. He works within the training academy at TRM Labs, and is an advisor to the Board of Asset Reality.

• Foreword xiiiIntroduction xvii1 A History of Cryptocurrencies and Crime 1Where Did It All Start? 3The Rise of the Smart Contract 7The Next Targets? 14The Future? More Crime! 162 Understanding the Criminal Opportunities: Money Laundering 19There Is No Such Thing as Crypto Crime 36Money Laundering 40What Is an Investigator Looking For? 42Centralized Exchanges 43NFTs and NFT Gaming 45Mixers 48Decentralized Exchanges 53Casinos. 56Chain Hopping 57Privacy Coins 59Crypto ATMs 62Peer-to-Peer Platforms 643 Understanding the Criminal Opportunities: Theft 67Crypto Thefts 67Social Engineering 67Phishing 68Hacks 71Fraud 73Rug Pull 74Pig-Butchering/Romance Scams 76Investment Scams 79Support Scams 83Simple Theft 84Contract Manipulation 86Fake Contracts 86Exploiting the Contract 87Phishing 89Flash Loans 90Playing by the Rules 92Other Criminal Opportunities 96Yield Farming 96Funding of Groups 97Sanctions Avoidance 99Summary 1084 Who Should Be a Cryptocurrency Investigator? 109Individual Skills 111Knowledge of Technological Systems 111Knowledge of Digital Currencies 112Understanding of the Cryptocurrency Market 112Extensive Knowledge of Computer Networks 113Cryptography 114Financial Crime 114Fraud Investigators 114Open Source Investigations 115Cybercrime Investigations 116Setting Up a Cryptocurrency Investigation Department 117Other Roles. 1235 The Role of Commercial Investigation Tools 125Do You Need a Commercial Tool? 129Two Is One and One Is None 133The Future of Investigation Tools 1356 Mining: The Key to Cryptocurrencies 139What Really Is Mining? 141Validating Transactions 141Minting New Coins 142Proof of Work (PoW) Mining 142How PoW Mining Works 142Energy Consumption and Environmental Concerns 145Proof of Stake (PoS) Mining 146How PoS Mining Works 146Advantages of PoS Mining 146Does an Investigator Need to Understand Mining Technologies? 146Cryptocurrency Mining Frauds and Scams 147Cloud Mining Scams 147Ponzi and Pyramid Schemes 148Malware and Cryptojacking 149Asset Discovery 149Will Cryptocurrencies Always Be Mined? 1507 Cryptocurrency Wallets 153When a Wallet Is Not Really a Wallet 155Types of Cryptocurrency Wallets 156Hot Wallets 157Desktop Wallets. 157Mobile Wallets 158Web/Online Wallets 158Cold Wallets 160Hardware Wallets 160Paper Wallets 161Software Wallets: Functionality and Security 162Functionality 163Security 163Hardware Wallets: Functionality and Security 164Functionality 164Security 164Choosing the Right Wallet 165Wallet Vulnerabilities 166Weak or Reused Passwords 166Phishing Attacks 166Malware 167On-Path Attacks 167Vulnerable Wallet Software 168Lack of Two-Factor Authentication (2FA) 168Social Engineering 169SIM-Swapping Attacks 169Supply Chain Attacks 1708 The Importance of Discovery 173Premises Searching: Legal Framework and Search Powers 176Search Strategies 177Handling and Securing Evidence 177Evidence Bags 178Body Cameras 179Photography 179Chain of Custody 180Physical Clues. 181Hardware Wallets 181Paper Wallets 183QR Codes 186Documentation 186Questioning 188General Understanding 188Involvement and Knowledge of Cryptocurrencies 188Specific Details of the Alleged Crime 189Technical Details 189Searching Digital Assets 190Legal Framework and Warrants 192Digital Forensics 194Hardware Examination 198Storage Devices 198RAM Analysis 200What are you looking for? 202Handling and Securing Digital Evidence 204The Role of Exchanges 204Senior Officers/Management 206Summary 2069 The Workings of Bitcoin and Derivatives 209Bitcoin Is a Blockchain-Based UTXO Cryptocurrency 210UTXO 211What Does an Transaction Look Like? 215How Does a UTXO Blockchain Help an Investigator? 220Blockchain Explorers 222What Else Can You Learn in a Transaction? 226Times and Dates 227Values 229Omni Layer 231Taproot 232The Lightning Network 235Summary 23710 Bitcoin: Investigation Methodology 239Building an Investigation in Bitcoin 251Address Clustering 253How Are Clusters Defined? 255Co-spend Heuristic 255Change Analysis 256Nominal Spend 257Address Type Analysis 259Multisig Analysis 260Round Number Payments 261Some Other Things to Note 262Change of Ownership 263Change of Wallet 263Look at the Amounts 263Address Triage 265Attribution 271Investigating Bitcoin 27111 The Workings of Ethereum and Derivatives 273History of the Ethereum Cryptocurrency 274Ethereum Fundamentals 276Types of Tokens 279Ethereum Transaction Types 282One Address for All Tokens 286A User’s Address Can Be the Same on Other Blockchains 288Reading Basic Transactions 290Transaction Methods 291Transaction and Address Types 293What Are These Contracts We Keep Mentioning? 294Identifying Contract Transactions 295Conclusion 29612 Ethereum: Investigation Methodology 297Following ETH-to-ETH Transactions 297Smart Contracts Deep Dive 304Methods, Functions, and Events 307Code 309Read Contract 310Write Contract. 310Logs 314ETH-to-Contract Transactions 316Token-to-Token Transactions 324NFTs 329Decentralized Exchanges 335Reading Decentralized Finance Contracts 342The Approve Transaction 351Summary 35313 Investigating Binance Smart Chain 355What is Binance Smart Chain? 355Investigating Funds on Binance Smart Chain 357What Have You Learned? 36414 Applying What You Have Learned to New Cryptocurrencies 367Stable Coins Such as USDT, USDC, and Paxos 368Tron 372Tron Fee Structure 372What Transactions Look Like 372Layer 2 Chains 377Bridges 383Mixers 388Bitcoin Mixing 389Ethereum Mixing 393Privacy Coins 395Monero (XMR): The Vanguard of Privacy Coins 396Zcash (ZEC): Selective Transparency 396Dash (DASH): Privacy as an Option 397Horizen (ZEN): Extended Privacy with Sidechains 397Grin and Beam: Mimblewimble Protocol 398What Have You Learned? 39815 Open Source Intelligence and the Blockchain 401Mindset 402Just “Search Engine” It 404Attribution of Individuals 412NFT Metadata 421OSINT and the Dark Web 423Summary 42516 Using Wallets for Investigations 427Understanding Cryptocurrency Wallets 427Seed Words and Wallet Recovery 428Step-by-Step Guide to HD Wallet Re-creation 428What Can Be Seen? 429The Benefits of Wallet Re-creation in Investigations 434Understanding Derivation Paths in Cryptocurrency Wallets 435The Importance of Understanding Derivation Paths for Investigators 435Avoiding Oversight and Ensuring Legal Admissibility 436The Concept of a Derivation Path 436Bitcoin vs Ethereum Derivation Paths 437Changing Derivation Paths in Software Wallets 438To Sum Up 44417 Crypto Seizure 445What Do You Need to Carry Out a Crypto Seizure? 463Recording Seed Words 466Seizing to Your Own Wallet 467Considerations for a Software Wallet 467Considerations for a Hardware Wallet 468Establishing an Organizational Process 469Document Your Processes 469Methods of Recording 470Paperwork 470Video 470Preparation and Administration 471Documentation in Law Enforcement Systems 471Questions to Ask before Carrying Out a Crypto Seizure 471Preparing for a Time-Sensitive Seizure 472On-Site Seizure Considerations 472Managing Access and Potential Threats 472On-Site Toolkit and Practice 473Where to Store Seized Assets? 473Seizing to an Exchange 473Specialist Custodians 474Seizing to a Law Enforcement–Controlled Wallet 475Final Thoughts 477Acknowledgments 483About the Author 485About the Contributors 487About the Technical Editor 493Index 495