Course Outline
Blockchain Technology Foundations
Architectural properties such as decentralization, openness, and transparency
Cryptographic primitives securing the chain, including hashing, digital signatures, and Merkle trees
Consensus mechanisms: Proof of Work, Proof of Stake, and emerging alternatives
Network topology involving nodes, miners, and validators in live environments
The Cryptocurrency Ecosystem
Bitcoin and the original ledger model
Ethereum and the execution of account-based smart contracts
Privacy-focused chains like Monero and Zcash, and how they diverge from transparent ledgers
The role of stablecoins and altchains in illicit financial flows
Practical Lab - Interpreting the Blockchain
Establishing connections to Bitcoin and Ethereum nodes for real-time data access
Navigating block explorers and querying live transactions
Analyzing raw transactions, scripts, and smart contract interactions
Mapping the transaction history of wallets on transparent chains
Wallets, Keys, and Transaction Mechanisms
Wallet classifications: web, desktop, mobile, hardware, and the distinction between custodial and non-custodial models
Seed phrases, key derivation processes, and recovery methods
Comparing UTXO-based and account-based transaction models
Addresses, change outputs, and transaction graphs from a forensic tracer’s viewpoint
Mining and Trading as Investigative Context
Mining mechanics, pools, hash rates, and the exploitation of mining for fund laundering or origination
Centralized exchanges, decentralized exchanges, and over-the-counter desks
KYC and AML controls within exchanges and their potential vulnerabilities
How trading patterns can obscure underlying corruption-related flows
Smart Contracts and DeFi Surfaces
Understanding smart contracts and the observability of their state on-chain
DeFi primitives including swaps, lending, liquidity pools, and yield farming
Cross-chain bridges and wrapped assets as tools for obfuscation
Analyzing contract interactions to identify investigative signals
Practical Lab - Wallet and Transaction Forensics
Examining hardware and software wallets within a controlled environment
Recovering and analyzing artifacts from seized devices
Reconstructing transaction graphs across both UTXO and account-based chains
Address Clustering and Attribution
Industry-standard heuristics such as common-input clustering
Detection of change outputs and identification of behavioral fingerprints
Linking on-chain entities to off-chain identities using OSINT
Integrating web crawling, social media data, and leaked information for attribution
Dark Web, Marketplaces, and Criminal Crypto Flows
Mapping criminal economic activities on dark web marketplaces
Common typologies including scams, fraud, contraband trade, and sanctions evasion
Tracking proceeds from initial deposits to final cash-out points
Identifying indicators of corruption-linked cryptocurrency activity
Privacy-Enhancing Tools and Counter-Forensics
Mixers, tumblers, and CoinJoin implementations
Privacy coins and the limitations of tracing on public chains
Cross-chain bridges and asset wrapping as obfuscation layers
Assessing the capabilities and limitations of tracing under various techniques
Practical Lab - Tracing Suspect Wallets
Utilizing open-source tools to follow complex transaction graphs
Clustering wallet networks and assigning confidence levels to attributions
Documenting findings as a structured intelligence package
Cryptocurrency Money Laundering Typologies
Adapting placement, layering, and integration stages to digital assets
Layering techniques via decentralized exchanges, bridges, and mixers
DeFi protocols as laundering surfaces and methods for interpreting them
Cash-out vectors including peer-to-peer markets, OTC desks, and prepaid instruments
Ransomware, Theft, and Scam Response
Ransomware payment patterns and immediate response protocols
Negotiation and recovery practices, along with associated limits and risks
Analysis of exchange hacks, rug pulls, phishing, and large-scale thefts
Collaborating with victims to preserve evidence without compromising the investigation
Cross-Chain Investigations
Tracing assets across Bitcoin, Ethereum, and other EVM-compatible chains
Following fund movements through bridges and wrapped tokens
Reconciling on-chain evidence with exchange and off-chain records
Simulated Exercise - Corruption Investigation Lab
Simulating bribery flows across multiple chains and through mixers
Constructing a coherent narrative from fragmented on-chain evidence
Creating chain-of-custody documentation for digital evidence
AML Compliance and Legal Frameworks
FATF guidance, the Travel Rule, and variations across jurisdictions
AML and KYC obligations for virtual asset service providers
Sanctions, politically exposed persons, and typologies relevant to corruption
Integrating cryptocurrency findings into existing compliance programs
Engaging Exchanges and Cross-Border Partners
Subpoenas, MLATs, and information-sharing channels
Freezing orders, asset preservation, and seizure procedures
Coordinating cryptocurrency tracing with traditional financial investigation lines
Digital Evidence and Courtroom Preparedness
Maintaining chain of custody for cryptocurrency artifacts and on-chain evidence
Presenting blockchain evidence to non-technical decision-makers and juries
Addressing common challenges to digital evidence and defending findings
Working with expert witnesses and external technical advisors
Capstone Project - End-to-End Corruption Inquiry Simulation
Working from the initial intelligence tip through the full investigation process
Building the wallet network, attribution analysis, and timeline
Engaging with exchanges and cross-border partners
Producing a courtroom-ready report and delivering an oral briefing
Summary and Next Steps
Requirements
- Intermediate technical proficiency, including knowledge of networking and basic Linux command-line operations
- A solid grasp of cryptographic concepts, such as hashing and public-key encryption
- Professional background in financial investigation, cybersecurity, forensics, or compliance
- Knowledge of at least one scripting language is advantageous but not mandatory
- General understanding of financial transactions and AML principles
Intended Audience
Investigators and forensic analysts working in anti-corruption agencies, financial crime units, and law enforcement. Cybersecurity specialists supporting fraud detection, AML, and digital evidence functions. Additionally, compliance and risk professionals operating in regulated environments where cryptocurrency exposure is expanding.
Testimonials (1)
- like the blockchain introduction. For a blockchain newbie like me, its englighten me. - Like the technical workshop, also interesting
