Course Outline
Blockchain Technology Fundamentals
Architectural characteristics including decentralization, openness, and transparency
Cryptographic elements securing the chain: hashing, digital signatures, and Merkle trees
Consensus protocols: Proof of Work, Proof of Stake, and other emerging models
Network components: nodes, miners, validators, and live network topology
Overview of the Cryptocurrency Ecosystem
Bitcoin and its foundational ledger structure
Ethereum and the execution of account-based smart contracts
Privacy-focused blockchains such as Monero and Zcash, and their distinction from transparent ledgers
The role of stablecoins and alternative chains in illicit financial flows
Practical Lab: Interpreting the Blockchain
Establishing connections to Bitcoin and Ethereum nodes for live data retrieval
Navigating block explorers and executing queries on live transactions
Analyzing raw transactions, scripts, and smart contract calls
Tracing the transaction history of a wallet on a transparent chain
Wallets, Keys, and Transaction Dynamics
Wallet classifications: web, desktop, mobile, hardware, and the distinction between custodial and non-custodial models
Seed phrases, key derivation processes, and recovery mechanisms
Comparing UTXO-based and account-based transaction models
Understanding addresses, change outputs, and transaction graphs from an investigator's perspective
Mining and Trading as Investigative Context
Mining mechanics, pool structures, hash rates, and methods of exploiting mining for fund origination or laundering
Differences between centralized exchanges, decentralized exchanges, and OTC desks
Implementation of KYC and AML controls at exchanges and potential failure points
How specific trading patterns can obscure underlying corruption schemes
Smart Contracts and the DeFi Environment
The nature of smart contracts and the observability of their state on-chain
Core DeFi mechanisms: swaps, lending, liquidity pools, and yield farming
The use of cross-chain bridges and wrapped assets for obfuscation
Extracting investigative signals from contract interactions
Practical Lab: Wallet and Transaction Forensics
Examining hardware and software wallets within a controlled environment
Recovering and analyzing data artifacts from seized devices
Reconstructing transaction graphs across both UTXO and account-based blockchains
Address Clustering and Attribution Techniques
Standard industry heuristics, including common-input clustering
Detection of change outputs and identification of behavioral patterns
Correlating on-chain entities with off-chain identities using OSINT
Utilizing web crawling, social media, and leaked data sources to establish attribution
Dark Web, Marketplaces, and Criminal Crypto Flows
Mapping criminal economies within dark web marketplaces
Common typologies including scams, fraud, contraband trade, and sanctions evasion
Tracking illicit proceeds from initial deposits to final cash-out points
Identifying indicators of corruption-related cryptocurrency activity
Privacy Tools and Counter-Forensic Measures
Operation of mixers, tumblers, and CoinJoin protocols
Privacy coins and the limitations of tracing on public chains
Cross-chain bridges and asset wrapping as additional layers of obfuscation
Assessing what tracing techniques can and cannot recover under various privacy methods
Practical Lab: Tracing a Suspect Wallet
Using open-source tools to navigate complex transaction graphs
Clustering wallet networks and assigning confidence levels to attributions
Compiling findings into a structured intelligence report
Cryptocurrency Money Laundering Typologies
Adapting placement, layering, and integration concepts to digital assets
Layering techniques via decentralized exchanges, bridges, and mixers
Utilizing DeFi protocols as laundering surfaces and methods for analysis
Cash-out methods: peer-to-peer markets, OTC desks, and prepaid instruments
Response to Ransomware, Theft, and Scams
Ransomware payment patterns and immediate response protocols
Negotiation and recovery practices, including associated limits and risks
Analysis of exchange hacks, rug pulls, phishing attacks, and large-scale thefts
Collaborating with victims to preserve evidence without compromising the investigation
Cross-Chain Investigations
Tracing assets across Bitcoin, Ethereum, and EVM-compatible blockchains
Following funds through bridges and wrapped tokens
Aligning on-chain evidence with exchange records and off-chain data
Simulation: Corruption Investigation Lab
Simulating bribery flows across multiple chains and mixers
Constructing a coherent narrative from fragmented on-chain data
Generating chain-of-custody documentation for digital evidence
AML Compliance and Legal Frameworks
FATF guidance, the Travel Rule, and jurisdictional variations
AML and KYC obligations for virtual asset service providers
Sanctions, politically exposed persons, and typologies relevant to corruption
Integrating cryptocurrency findings into existing compliance programs
Engaging with Exchanges and Cross-Border Partners
Utilizing subpoenas, MLATs, and information-sharing channels
Executing freezing orders, asset preservation, and seizure procedures
Coordinating cryptocurrency tracing with traditional financial investigation efforts
Digital Evidence and Courtroom Preparation
Maintaining chain of custody for cryptocurrency artifacts and on-chain evidence
Presenting blockchain evidence to non-technical decision-makers and juries
Addressing common challenges to digital evidence and defending investigative findings
Collaborating with expert witnesses and external technical advisors
Capstone: End-to-End Corruption Inquiry Simulation
Conducting a full investigation starting from an initial intelligence tip
Constructing wallet networks, attributions, and timelines
Engaging with exchanges and cross-border partners
Producing a courtroom-ready report and delivering an oral briefing
Conclusion and Future Steps
Requirements
- Intermediate technical proficiency, including networking knowledge and basic Linux command-line skills
- A practical grasp of cryptographic concepts, such as hashing and public-key encryption
- Relevant experience in financial investigation, cybersecurity, forensics, or compliance
- Knowledge of at least one scripting language is advantageous but not mandatory
- General familiarity with financial transactions and AML principles
Intended Audience
This course is tailored for investigators and forensic analysts working in anti-corruption agencies, financial crime units, and law enforcement. It also suits cybersecurity specialists supporting fraud detection, AML, and digital evidence functions, as well as compliance and risk professionals in regulated sectors facing increasing cryptocurrency exposure.
Testimonials (1)
- like the blockchain introduction. For a blockchain newbie like me, its englighten me. - Like the technical workshop, also interesting
