Cryptocurrency And Blockchain Tracing

CRYPTOCURRENCY & BLOCKCHAIN · AGUIDEFORUKLAWYERS Cryptocurrency and Blockchain Tracing Following the Money on a Public Ledger, and Naming the Person Behind the Address COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM WALLET & EXCHANGE FORENSICS CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: visible money, hidden owners 03 How blockchains and wallets record value 04 Tracing funds across the ledger 05 Attribution: linking an address to a person 06 Obfuscation, honest limits and confidence 07 Deployment: freezing, disclosure and recovery 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary The headline point: most cryptocurrency runs on public ledgers that record every transaction permanently, so funds are highly traceable, and the real work is attribution, tying an address to a person through exchanges, devices and off-chain evidence, and doing so at honest confidence despite mixers and other obfuscation. KYC § 0 2 · FIRSTPRINCIPLES The problem in plain English: visible money, hidden owners § 0 3 · HOWITRECORDSVALUE How blockchains and wallets record value LEDGER ADDRESS WALLET / KEYS EXCHANGE PERSON § 0 4 · TRACING Tracing funds across the ledger § 0 5 · ATTRIBUTION Attribution: linking an address to a person § 0 6 · OBFUSCATIONANDHONESTLIMITS Obfuscation, honest limits and confidence § 0 7 · DEPLOYMENT Deployment: freezing, disclosure and recovery § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE THE EXCHANGE PERSON'S BACKUPS / NOTES / DELETED / BLOCKCHAIN RECORDS DEVICES CLOUD PAPER RECOVERABLE § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEFRAUDTRACEDTHROUGHTHEMIXERTOTHEEXCHANGE EXAMPLE2 · THESEEDPHRASETHATPROVEDCONTROL EXAMPLE3 · THEHIDDENHOLDINGSINTHEDIVORCE § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent (or an exchange) Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORACRYPTOCURRENCYTR AC INGAND AT TRIBUTION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The crypto-tracing checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Isn't cryptocurrency untraceable? If we can trace the funds, do we know who owns them? What is a seed phrase, and why does it matter so much? The funds went through a mixer. Is the trail dead? Can crypto be frozen and recovered? Could someone be hiding cryptocurrency in our matter? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY