Cryptoasset Typologies and Illicit Finance Risks
This domain tests whether you can classify illicit activity and explain the laundering path, not just name a scam. Expect questions on fraud, ransomware, darknet markets, sanctions evasion, and the layering techniques that move proceeds across assets and chains.
Common typologies
- Investment and romance fraud, including pig-butchering: the victim sends funds to a controlled deposit address, which consolidates to a collection wallet and converts to stablecoins.
- Ransomware: victims pay in BTC or XMR to a per-victim address; operators consolidate and cash out through nested exchanges or mixers.
- Theft and exploits: bridge and DeFi hacks move funds rapidly through DEX swaps, bridges and mixers.
- Sanctions evasion and terror financing: use of unregistered VASPs, hawala-like value transfer, and privacy assets.
Layering indicators
Pass-through wallets with short dwell time, fan-in to a collector, peel chains, round-number payments, use of fresh addresses, chain-hopping, and conversion to privacy coins or mixer deposits.
Worked example
A victim reports a romance scam and provides one Bitcoin address. The address receives 0.7 BTC and within minutes sends to a wallet that has received from 40 other addresses. That wallet converts to USDT-TRON and sends to a suspected mixer. Reasoning: the fan-in pattern suggests a collection wallet, not proof of a single operator; the stablecoin conversion is a common cash-out preparation step because TRON fees are low and liquidity is deep. The report should describe the typology, the observed hops, and the confidence level.
Traps
- Calling funds hacked when the victim authorised the transfer.
- Assuming privacy coins are untraceable or that mixers remove all evidence.
- Ignoring the difference between a scam wallet and an exchange deposit address.
- Overstating attribution from a single typology match.