Course Outline
Foundations of Blockchain Technology
The architectural properties of decentralization, openness, and transparency
Cryptographic primitives securing the chain: hashing algorithms, digital signatures, and Merkle trees
Consensus mechanisms: Proof of Work, Proof of Stake, and emerging alternatives
Network topology involving nodes, miners, and validators in a live environment
The Cryptocurrency Landscape
Bitcoin and the foundational ledger model
Ethereum and account-based smart contract execution
Privacy-focused chains: Monero, Zcash, and their distinctions from transparent ledgers
Stablecoins and alternative chains (altchains) and their involvement in illicit fund flows
Practical Lab - Reading the Blockchain
Establishing connections to Bitcoin and Ethereum nodes for live data access
Navigating block explorers and querying live transactions
Analyzing raw transactions, scripts, and smart contract interactions
Mapping wallet histories on transparent blockchains
Wallets, Keys, and Transaction Mechanics
Wallet classification: web, desktop, mobile, hardware, and custodial versus non-custodial models
Seed phrases, key derivation processes, and recovery vectors
Differences between UTXO and account-based transaction models
Addresses, change outputs, and transaction graph analysis from an investigator's viewpoint
Mining and Trading as Investigative Context
Mining mechanics, pools, hash rate, and exploitation methods for fund laundering or origination
Centralized exchanges (CEXs), decentralized exchanges (DEXs), and over-the-counter (OTC) desks
KYC and AML controls at exchanges and potential points of failure
How trading patterns may obscure underlying corruption flows
Smart Contracts and the DeFi Surface
Understanding smart contracts and on-chain observability of their state
DeFi primitives: swaps, lending protocols, liquidity pools, and yield farming mechanisms
Cross-chain bridges and wrapped assets as tools for obfuscation
Analyzing contract interactions for investigative signals
Practical Lab - Wallet and Transaction Forensics
Inspecting hardware and software wallets in a controlled environment
Recovering and analyzing artifacts from seized devices
Reconstructing transaction graphs across UTXO and account-based chains
Address Clustering and Attribution
Common-input clustering and other industry-standard heuristic methods
Detecting change outputs and identifying behavioral fingerprints
Linking on-chain entities to off-chain identities via Open-Source Intelligence (OSINT)
Integrating web crawling, social media, and leaked data sources for attribution
Dark Web, Marketplaces, and Criminal Cryptocurrency Flows
Mapping criminal economies within dark web marketplaces
Common typologies: scams, fraud, contraband sales, and sanctions evasion
Tracking proceeds from initial deposit through cash-out points
Indicators of corruption-linked cryptocurrency activity
Privacy-Enhancing Tools and Counter-Forensics
Mixers, tumblers, and CoinJoin implementations
Privacy coins and the limitations of public-chain tracing
Cross-chain bridges and asset wrapping as obfuscation layers
Capabilities and limitations of tracing under each technique
Practical Lab - Tracing a Suspect Wallet
Utilizing open-source tools to follow complex transaction graphs
Clustering wallet networks and assigning confidence levels to attribution
Documenting findings as structured intelligence packages
Money Laundering Typologies in Crypto
Placement, layering, and integration phases adapted for digital assets
Layering techniques via decentralized exchanges, bridges, and mixers
DeFi protocols as laundering surfaces and methods for analyzing them
Cash-out vectors: peer-to-peer markets, OTC desks, and prepaid instruments
Ransomware, Theft, and Scam Response
Ransomware payment patterns and immediate response protocols
Negotiation and recovery practices, including associated limits and risks
Analyzing exchange hacks, rug pulls, phishing attacks, and large-scale thefts
Collaborating with victims to preserve evidence without compromising investigations
Cross-Chain Investigation
Tracing assets across Bitcoin, Ethereum, and EVM-compatible chains
Following funds through bridges and wrapped tokens
Reconciling on-chain evidence with exchange and off-chain records
Practical Simulation - Corruption Investigation Lab
Simulated bribery flows across multiple chains and mixers
Constructing a coherent narrative from fragmented on-chain evidence
Generating chain-of-custody documentation for digital evidence
AML Compliance and the Legal Landscape
FATF guidance, the Travel Rule, and jurisdictional variations
AML and KYC obligations across Virtual Asset Service Providers (VASPs)
Sanctions regimes, politically exposed persons (PEPs), and corruption-relevant typologies
Integrating cryptocurrency findings into existing compliance frameworks
Liaising with Exchanges and Cross-Border Partners
Subpoenas, Mutual Legal Assistance Treaties (MLATs), and information-sharing channels
Freezing orders, asset preservation measures, and seizure procedures
Coordinating cryptocurrency tracing with traditional financial investigation avenues
Digital Evidence and Courtroom Readiness
Establishing chain of custody for cryptocurrency artifacts and on-chain evidence
Presenting blockchain evidence to non-technical decision-makers and juries
Addressing common challenges to digital evidence and defending findings
Collaborating with expert witnesses and external technical advisors
Capstone - End-to-End Corruption Inquiry Simulation
Conducting an investigation from initial intelligence tip to conclusion
Developing wallet networks, attribution analysis, and timelines
Liaising with exchanges and cross-border partners
Producing a courtroom-ready report and delivering an oral briefing
Summary and Next Steps
Requirements
- Intermediate technical proficiency, encompassing networking fundamentals and basic Linux command-line operations
- Working knowledge of cryptographic principles, including hashing algorithms and public-key encryption
- Professional background in financial investigation, cybersecurity, digital forensics, or regulatory compliance
- Familiarity with at least one scripting language is beneficial but not mandatory
- General understanding of financial transaction structures and AML principles
Targeted Audience
Investigators and forensic analysts employed by anti-corruption agencies, financial crime units, and law enforcement bodies. Cybersecurity specialists supporting fraud prevention, AML initiatives, and digital evidence functions. Compliance and risk management professionals operating within regulated sectors where cryptocurrency exposure is progressively increasing.
Testimonials (1)
- like the blockchain introduction. For a blockchain newbie like me, its englighten me. - Like the technical workshop, also interesting
