Course Outline
Foundations of Blockchain Technology
Understanding decentralization, openness, and transparency as core architectural properties
Cryptographic primitives securing the chain: hashing, digital signatures, and Merkle trees
Consensus mechanisms: Proof of Work (PoW), Proof of Stake (PoS), and emerging alternatives
Network topology involving nodes, miners, and validators in a live environment
Cryptocurrency Landscape
Bitcoin and the foundational ledger model
Ethereum and account-based smart contract execution
Privacy-centric chains: Monero, Zcash, and their distinctions from transparent ledgers
The role of stablecoins and alternative chains in illicit financial flows
Hands-On Lab - Reading the Blockchain
Connecting to Bitcoin and Ethereum nodes for live data retrieval
Navigating block explorers and querying real-time transactions
Analyzing raw transactions, scripts, and smart contract calls
Mapping wallet histories on transparent chains
Wallets, Keys, and Transaction Mechanics
Wallet classifications: web, desktop, mobile, hardware, and custodial versus non-custodial options
Seed phrases, key derivation processes, and recovery methods
Comparing UTXO and account-based transaction models
Analyzing addresses, change outputs, and transaction graphs from a tracer's viewpoint
Mining and Trading as Investigative Context
Mining operations, pools, hash rate dynamics, and how mining mechanisms are exploited for fund laundering or origination
Interactions between centralized exchanges, decentralized exchanges (DEX), and over-the-counter (OTC) desks
KYC and AML controls at exchanges and points of failure
Analyzing how trading patterns can obscure underlying corrupt flows
Smart Contracts and DeFi Surface
Understanding smart contracts and the observability of their state on-chain
DeFi primitives: swaps, lending protocols, liquidity pools, and yield farming mechanisms
Cross-chain bridges and wrapped assets as obfuscation techniques
Extracting investigative signals from contract interactions
Hands-On Lab - Wallet and Transaction Forensics
Inspecting hardware and software wallets in a controlled setting
Recovering and analyzing artifacts from seized devices
Reconstructing transaction graphs across UTXO and account-based networks
Address Clustering and Attribution
Common-input clustering and other industry-standard heuristic methods
Detecting change outputs and identifying behavioral fingerprints
Linking on-chain entities to off-chain identities using Open Source Intelligence (OSINT)
Integrating web crawling, social media, and leaked data sources for attribution
Dark Web, Marketplaces, and Criminal Cryptocurrency Flows
Mapping criminal economies within dark web marketplaces
Common typologies: scams, fraud, contraband sales, and sanctions evasion
Tracking proceeds from initial deposit through to cash-out stages
Identifying indicators of corruption-linked crypto activity
Privacy-Enhancing Tools and Counter-Forensics
Analysis of mixers, tumblers, and CoinJoin implementations
Privacy coins and the limitations of public-chain tracing
Cross-chain bridges and asset wrapping as layers of obfuscation
Assessing what tracing techniques can and cannot recover under various methods
Hands-On Lab - Tracing a Suspect Wallet
Utilizing open-source tools to follow complex transaction graphs
Clustering wallet networks and assigning confidence levels to attributions
Documenting findings into a structured intelligence package
Money Laundering Typologies in Crypto
Placement, layering, and integration phases adapted for digital assets
Layering techniques through DEXs, bridges, and mixers
Analyzing DeFi protocols as laundering surfaces
Cash-out vectors: peer-to-peer markets, OTC desks, and prepaid instruments
Ransomware, Theft, and Scam Response
Ransomware payment patterns and immediate response protocols
Negotiation strategies and recovery practices, including associated limits and risks
Analyzing exchange hacks, rug pulls, phishing attacks, and large-scale thefts
Collaborating with victims to preserve evidence without compromising the investigation
Cross-Chain Investigation
Tracing assets across Bitcoin, Ethereum, and EVM-compatible chains
Following funds through bridges and wrapped tokens
Reconciling on-chain evidence with exchange records and off-chain data
Hands-On Simulation - Corruption Investigation Lab
Simulating bribery flows across multiple chains and a mixer
Constructing a coherent narrative from fragmented on-chain evidence
Generating chain-of-custody documentation for digital evidence
AML Compliance and the Legal Landscape
FATF guidance, the Travel Rule, and jurisdictional variances
AML and KYC obligations for Virtual Asset Service Providers (VASPs)
Sanctions compliance, Politically Exposed Persons (PEPs), and corruption-relevant typologies
Integrating cryptocurrency findings into existing compliance frameworks
Working with Exchanges and Cross-Border Partners
Utilizing subpoenas, Mutual Legal Assistance Treaties (MLATs), and information-sharing channels
Executing freezing orders, asset preservation, and seizure procedures
Coordinating cryptocurrency tracing with traditional financial investigation lines
Digital Evidence and Courtroom Readiness
Establishing chain of custody for cryptocurrency artifacts and on-chain evidence
Presenting blockchain evidence to non-technical decision-makers and juries
Addressing common challenges to digital evidence and defending findings
Collaborating with expert witnesses and external technical advisors
Capstone - End-to-End Corruption Inquiry Simulation
Conducting a full investigation from the initial intelligence tip
Building wallet networks, establishing attribution, and creating timelines
Liaising with exchanges and cross-border partners
Producing a courtroom-ready report and delivering oral briefings
Summary and Next Steps
Requirements
- Intermediate technical proficiency, including networking knowledge and basic Linux command-line operations
- Working knowledge of cryptographic concepts such as hashing algorithms and public-key encryption
- Background experience in financial investigation, cybersecurity, forensics, or regulatory compliance
- Familiarity with at least one scripting language is advantageous but not mandatory
- General understanding of financial transaction structures and AML principles
Targeted Audience
Investigators and forensic analysts working within anti-corruption agencies, financial crime units, and law enforcement bodies. Cybersecurity specialists supporting fraud detection, AML operations, and digital evidence analysis. Compliance and risk professionals operating in regulated environments where exposure to cryptocurrency-related risks is growing.
Testimonials (1)
- like the blockchain introduction. For a blockchain newbie like me, its englighten me. - Like the technical workshop, also interesting
