Course Outline
Foundations of Blockchain Technology
Decentralization, openness, and transparency as core architectural features
Cryptographic primitives ensuring chain security: hashing, digital signatures, and Merkle trees
Consensus mechanisms: Proof of Work, Proof of Stake, and emerging alternatives
Network topology involving nodes, miners, validators, and live network structures
Cryptocurrency Landscape
Bitcoin and the foundational ledger model
Ethereum and account-based smart contract execution
Privacy-focused chains: Monero, Zcash, and their distinctions from transparent ledgers
The role of stablecoins and altchains in illicit financial flows
Hands-On Lab - Reading the Blockchain
Establishing connections to Bitcoin and Ethereum nodes for real-time data access
Navigating block explorers and querying live transactions
Analyzing raw transactions, scripts, and smart contract interactions
Tracing wallet histories on transparent chains
Wallets, Keys, and Transaction Mechanics
Wallet classifications: web, desktop, mobile, hardware, custodial vs. non-custodial
Seed phrases, key derivation processes, and recovery methods
Comparison of UTXO and account-based transaction models
Addresses, change outputs, and transaction graph analysis from an investigator's viewpoint
Mining and Trading as Investigative Context
Mining operations, pools, hash rates, and their exploitation for laundering or fund origination
Centralized exchanges, decentralized exchanges (DEXs), and over-the-counter (OTC) desks
KYC and AML controls at exchanges and their vulnerabilities
How trading patterns can obscure underlying corrupt financial flows
Smart Contracts and DeFi Surface
Understanding smart contracts and their observable on-chain state
DeFi components: swaps, lending, liquidity pools, and yield farming
Cross-chain bridges and wrapped assets as obfuscation mechanisms
Extracting investigative signals from contract interactions
Hands-On Lab - Wallet and Transaction Forensics
Examining hardware and software wallets in a secure environment
Recovering and analyzing artifacts from confiscated devices
Reconstructing transaction graphs across UTXO and account-based networks
Address Clustering and Attribution
Common-input clustering and other industry-standard heuristic methods
Detection of change outputs and behavioral fingerprinting
Connecting on-chain entities to off-chain identities via OSINT
Integrating web crawling, social media, and leaked data sources for attribution
Dark Web, Marketplaces, and Criminal Cryptocurrency Flows
Mapping criminal economies within dark web marketplaces
Common typologies: scams, fraud, contraband sales, and sanctions evasion
Tracking proceeds from initial deposit through cash-out stages
Indicators of crypto activity linked to corruption
Privacy-Enhancing Tools and Counter-Forensics
Mixers, tumblers, and CoinJoin implementations
Privacy coins and the limitations of public-chain tracing
Cross-chain bridges and asset wrapping as obfuscation layers
Determining what tracing can and cannot recover under various techniques
Hands-On Lab - Tracing a Suspect Wallet
Utilizing open-source tools to follow complex transaction graphs
Clustering wallet networks and assigning confidence levels to attributions
Documenting findings as a structured intelligence package
Money Laundering Typologies in Crypto
Placement, layering, and integration adapted for digital assets
Layering techniques through DEXs, bridges, and mixers
DeFi protocols as laundering surfaces and methods for analysis
Cash-out vectors: peer-to-peer markets, OTC desks, and prepaid instruments
Ransomware, Theft, and Scam Response
Ransomware payment patterns and immediate response protocols
Negotiation and recovery practices, including limitations and risks
Analysis of exchange hacks, rug pulls, phishing, and large-scale thefts
Collaborating with victims to preserve evidence without compromising investigations
Cross-Chain Investigation
Tracing assets across Bitcoin, Ethereum, and EVM-compatible networks
Following funds through bridges and wrapped tokens
Reconciling on-chain evidence with exchange and off-chain records
Hands-On Simulation - Corruption Investigation Lab
Simulating a bribery flow across multiple chains and a mixer
Constructing a coherent narrative from fragmented on-chain evidence
Generating chain-of-custody documentation for digital evidence
AML Compliance and the Legal Landscape
FATF guidelines, the Travel Rule, and jurisdictional variations
AML and KYC obligations for Virtual Asset Service Providers (VASPs)
Sanctions, politically exposed persons (PEPs), and corruption-relevant typologies
Integrating cryptocurrency findings into existing compliance frameworks
Working with Exchanges and Cross-Border Partners
Subpoenas, Mutual Legal Assistance Treaties (MLATs), and information-sharing channels
Freezing orders, asset preservation, and seizure procedures
Coordinating cryptocurrency tracing with traditional financial investigation methods
Digital Evidence and Courtroom Readiness
Maintaining chain of custody for cryptocurrency artifacts and on-chain evidence
Presenting blockchain evidence to non-technical stakeholders and juries
Addressing common challenges to digital evidence and defending findings
Collaborating with expert witnesses and external technical advisors
Capstone - End-to-End Corruption Inquiry Simulation
Conducting a full investigation from initial intelligence lead to conclusion
Constructing the wallet network, attribution analysis, and timeline
Engaging with exchanges and cross-border partners
Delivering a courtroom-ready report and oral briefing
Summary and Next Steps
Requirements
- Intermediate technical proficiency, including networking fundamentals and basic Linux command-line operations
- Functional understanding of cryptographic principles such as hashing and public-key encryption
- Background in financial investigation, cybersecurity, digital forensics, or compliance
- Familiarity with at least one scripting language is advantageous but not mandatory
- General grasp of financial transaction mechanisms and AML principles
Targeted Audience
Investigators and forensic analysts working within anti-corruption agencies, financial crime units, and law enforcement bodies. Cybersecurity experts supporting fraud detection, AML initiatives, and digital evidence operations. Compliance and risk professionals operating in regulated sectors facing increasing cryptocurrency exposure.
Testimonials (1)
- like the blockchain introduction. For a blockchain newbie like me, its englighten me. - Like the technical workshop, also interesting
