FCIBT cheat sheet

A blockchain is an append-only ledger of cryptographically linked blocks; each block header contains the hash of its predecessor, so altering a past block invalidates every later hash unless the attacker redoes the accumulated proof-of-work or stake.

UTXO model (Bitcoin): coins are discrete outputs; a transaction consumes whole outputs and creates new ones, with unspent change returned to a new address. Balance is the sum of unspent outputs, not a stored number.

Account model (Ethereum and most EVM chains): each address has a balance, nonce, and code; transactions are ordered per-sender by nonce, so a stuck low-fee transaction blocks later ones from the same sender.

Public-key cryptography: a private key signs; the public key verifies. Addresses are derived by hashing the public key (e.g. SHA-256 then RIPEMD-160 for Bitcoin; Keccak-256 for Ethereum). A private key can never be recovered from an address.

A transaction is final only in economic terms: Bitcoin confirmation depth matters because reorgs are possible; exchanges typically credit after several confirmations. Ethereum PoS finality is checkpoint-based (two epochs), but reorgs of a few blocks still occur.

Gas (Ethereum): gas used x gas price (in wei), plus EIP-1559 base fee burned and priority fee to the validator. 1 ether = 10^18 wei; 1 BTC = 10^8 satoshi.

Node types: full node validates all rules and stores the chain; archive node keeps full historical state; light client verifies headers only. Investigators relying on a block explorer are trusting a third-party node operator.

Hard fork = rule change not backward compatible (chain split possible, e.g. BTC/BCH); soft fork = backward-compatible tightening. Forked chains share history up to the split block, so pre-fork addresses exist on both.

FATF categories: virtual asset (VA) and virtual asset service provider (VASP). A VASP is any business conducting exchange, transfer, safekeeping/administration, or participation in financial services on behalf of a customer.

Payment tokens (BTC, ETH), utility tokens, and asset-referenced/stablecoins carry different risk profiles; privacy coins (Monero, Zcash shielded) defeat transparent-ledger analytics and raise the risk rating.

Common typologies: ransomware payments, darknet market proceeds, investment/romance fraud (pig butchering), mixer and bridge layering, NFT wash trading, unregistered securities fraud, and sanctions evasion.

Stablecoins are the dominant settlement rail for illicit flows because they offer price stability and deep liquidity; issuer freeze functions (e.g. blacklist at the token contract) are a key disruption lever.

Terrorist financing in crypto typically involves small amounts moved through low-KYC channels, cash-to-crypto at ATMs, and hawala-style networks with crypto settlement, rather than large on-chain transfers.

Red flags: funds from a sanctioned address, exposure to a mixer within 1-2 hops, structuring of deposits just under reporting thresholds, use of multiple new addresses in sequence, and counterparties with no apparent economic rationale.

Typology vs. predicate offence: the predicate offence (fraud, drug trafficking) is the underlying crime; the typology describes the money-movement pattern used to conceal or move its proceeds.

Risk-based approach: severity x likelihood, weighted by the institution's exposure (volume, jurisdiction, customer type). Not every high-risk exposure requires exit; documented mitigation may suffice.

Heuristics for tracing: common-input-ownership (inputs spent together are controlled by one entity), change-address identification (the output that is neither a round number nor a known payment is likely change), and address reuse.

Peeling chain: a large input is repeatedly split, sending a payment and returning change to a new address each time; following the change trail often leads to a deposit address at a service.

First-in, first-out / FIFO and last-in, first-out (LIFO) are competing assumptions for attributing value through a transaction with multiple inputs; document which model you use because results differ.

Value in a transaction is not traceable at the satoshi level in the UTXO model beyond the transaction itself; tracing is a heuristic reconstruction, not a cryptographic proof of ownership.

Graph analysis: build directed graphs of addresses and transactions; use in-degree/out-degree, temporal ordering, and value thresholds to prune noise. Tools: Chainalysis Reactor, TRM Labs, Elliptic Investigator, plus open-source explorers.

Bridges and wrapped assets move value across chains; tracing must follow the lock-and-mint or burn-and-release event, recording the source-chain tx hash, the bridge contract, and the destination-chain mint tx.

Cross-chain hops reset heuristics: common-input-ownership does not apply across chains, and a change address on one chain has no relationship to an address on another unless a bridge or swap links them.

Timestamp and block height are evidentiary anchors; record both, plus the block hash, so a reorg or explorer discrepancy can be detected later.

Clustering groups addresses presumed to share one controller. Common-input-ownership is the strongest heuristic; change-address reuse and deposit-address reuse are weaker corroborating signals.

Attribution maps a cluster to a real-world entity using public data: exchange deposit addresses published in proof-of-reserves or support pages, mining pool payout addresses, known service wallets, and law-enforcement seizure announcements.

False positives arise from CoinJoin (multiple owners sign one transaction), custodial services co-spending customer funds, and exchanges batching withdrawals from one hot wallet. Label such clusters as 'service' rather than a single person.

Wallet identification: a deposit address is unique per customer at many exchanges; matching an on-chain address to a customer requires a subpoena or exchange records, not on-chain inference alone.

Confidence tiers: confirmed (documented by the entity or a court record), probable (multiple independent heuristics agree), possible (single heuristic). Report the tier with every attribution.

Entity vs. address vs. cluster: an entity may control many clusters (hot, cold, fee wallets); collapsing them into one label loses the operational distinction needed for tracing.

Sanctions screening of addresses relies on published lists (OFAC SDN, EU, UK); a match requires exact address comparison, and the same address may appear on multiple lists with different identifiers.

Document the heuristic, the tool version, and the date of analysis; heuristics and labels change over time, so a later reviewer must be able to reproduce the original conclusion.

Mixers (tumblers) pool deposits and pay out to unrelated addresses, breaking the direct link. Custodial mixers (e.g. Bitcoin Fog, Helix) leave records with the operator; decentralized protocols (e.g. Tornado Cash) use smart contracts.

CoinJoin: multiple parties jointly sign one transaction with equal-value outputs. It is not a mixer operator; Whirlpool and Wasabi are implementations. Equal outputs are the anonymity set; timing and amount correlation can deanonymize.

Privacy coins: Monero hides sender, receiver, and amount by default (ring signatures, stealth addresses, RingCT); Zcash offers shielded pools. Transparent-ledger analytics are largely ineffective; exchange deposit records become the main lead.

Cross-chain bridges: lock-and-mint (custodial or validator-set) vs. liquidity pools. Bridge hacks are a major theft category; tracing follows the minted asset on the destination chain and the bridge's own contracts.

Chain-hopping via DEX swaps and bridges is a common layering step; record each hop with tx hash, chain, timestamp, asset, and amount, and flag any privacy tool encountered.

Sanctions exposure: Tornado Cash was designated by OFAC in August 2022; later delisting and court challenges mean analysts must check the current status and date of any list relied upon.

Anonymity-set size, not the tool name, determines the difficulty of tracing. A mixer with one deposit and one withdrawal provides no anonymity; large pools with time delays are harder.

Peer-to-peer and no-KYC swap services are a growing substitute for mixers; they often lack travel-rule compliance records, so on-chain linkage to a service deposit address is the primary lead.

On-ramp types: centralized exchange (CEX), fiat-to-crypto payment processor, crypto ATM, and peer-to-peer marketplace. Each has a different KYC standard and record-retention profile.

CEX deposit addresses are usually per-customer and permanent; the exchange holds the private keys, so a subpoena to the exchange can identify the customer behind a deposit address.

Crypto ATMs: many jurisdictions require ID above a threshold; structuring below the threshold, repeated small buys, and use of a third party's wallet are red flags.

VASP due diligence: licensing status and jurisdiction, AML program (KYC, transaction monitoring, SAR filing), sanctions screening, travel-rule compliance, and whether the VASP serves US or EU persons without registration.

Proof of reserves and attestations are not audits; check who performed the attestation, the date, and whether liabilities (customer deposits) are included, not just assets.

Correspondent/nested relationships: a VASP that accesses another VASP's accounts is a nested relationship; it obscures the ultimate originator and requires enhanced due diligence.

Off-ramp tracing: the last hop before fiat is usually a deposit to an exchange or a P2P counterparty. That hop is the highest-value lead because it is where identity records exist.

Jurisdictional arbitrage: a VASP licensed in a weak regime may still serve customers in a strict one; check the customer's IP, KYC documents, and the VASP's terms of service for restricted jurisdictions.

FATF Recommendation 15 (as revised 2019) extends AML/CFT to virtual assets and VASPs; Recommendation 16 (travel rule) applies to VA transfers between VASPs.

Travel rule threshold and data: originator name, account/address, and (where required) address or national ID; beneficiary name and account. The EU Transfer of Funds Regulation sets a zero threshold for crypto transfers between PSPs.

Sanctions are strict liability in many regimes: a match on a designated address requires blocking and reporting, not a risk-based judgment call. Screen at onboarding and on every transaction.

OFAC 50% rule: an entity owned 50% or more, directly or indirectly, by one or more blocked persons is itself blocked, even if not separately listed.

Suspicious transaction reporting: file with the national FIU (e.g. FinCEN SAR, UK NCA SAR, EU FIU). Tipping off the subject is prohibited in most regimes.

Record-keeping: retain KYC, transaction, and investigation records for the statutory period (commonly 5 years after the relationship ends or the transaction); align with local law, which may differ.

A VASP that cannot comply with the travel rule must have a documented policy: obtain the missing information, or restrict/terminate the transfer. 'Sunrise' periods mean enforcement dates differ by jurisdiction.

Risk assessment must be documented and current; supervisors expect a business-wide risk assessment plus customer and transaction-level risk scoring, with the methodology written down.

Chain of custody: record who collected each item, when, where, and how; every transfer of custody is logged. A break in the chain can render evidence inadmissible or diminish its weight.

Hash the evidence at collection (SHA-256 of the file or disk image) and re-verify at each handoff; store the hash in the case file, not only on the evidence media.

On-chain evidence: capture the tx hash, block height, block hash, timestamp, explorer URL, and a screenshot or PDF export. Explorers are third-party services and can change; preserve the raw data.

Wallet and device seizure: image the device before interaction, preserve seed phrases and private keys in sealed evidence, and document the seizure location and the device's state (locked/unlocked).

Reports should separate fact (on-chain data, records obtained) from inference (heuristic attribution) and state the confidence level and method for each conclusion.

Case file structure: summary, scope, methodology, timeline, entity/address table, exhibits index, and limitations. A reviewer should be able to reproduce the tracing from the exhibits alone.

Jurisdictional coordination: mutual legal assistance (MLA) requests for exchange records abroad; preservation letters to prevent data deletion before the formal request is served.

Testimony readiness: be able to explain each heuristic, its error rate, and why the conclusion holds despite known false positives (e.g. CoinJoin, custodial co-spending).