Course Outline
Foundations of Blockchain Technology
An exploration of decentralization, openness, and transparency as core architectural attributes
Cryptographic primitives ensuring chain integrity: hashing, digital signatures, and Merkle trees
Consensus mechanisms including Proof of Work, Proof of Stake, and emerging alternatives
The roles of nodes, miners, validators, and the topology of live networks
Cryptocurrency Landscape
Bitcoin and its foundational ledger architecture
Ethereum and the execution of account-based smart contracts
Privacy-centric chains: Monero, Zcash, and their distinctions from transparent ledgers
The role of stablecoins, altchains, and other assets in illicit financial flows
Hands-On Lab - Reading the Blockchain
Connecting to Bitcoin and Ethereum nodes for real-time data retrieval
Navigating block explorers and querying live transaction data
Analyzing raw transactions, scripts, and smart contract calls
Mapping wallet histories on transparent blockchain networks
Wallets, Keys, and Transaction Mechanics
Wallet classifications: web, desktop, mobile, hardware, and custodial versus non-custodial solutions
Seed phrases, key derivation processes, and recovery methods
Differences between UTXO and account-based transaction models
Addresses, change outputs, and transaction graph analysis from an investigator's viewpoint
Mining and Trading as Investigative Context
Mining mechanics, pool structures, hash rate dynamics, and how mining is exploited for fund laundering or creation
Centralized exchanges (CEX), decentralized exchanges (DEX), and over-the-counter (OTC) desks
KYC and AML controls at exchanges and their potential vulnerabilities
How trading behaviors can obscure underlying corruption flows
Smart Contracts and DeFi Surface
Understanding smart contracts and the observability of their state on-chain
DeFi building blocks: swaps, lending protocols, liquidity pools, and yield farming
Cross-chain bridges and wrapped assets as methods of obfuscation
Analyzing contract interactions to identify investigative indicators
Hands-On Lab - Wallet and Transaction Forensics
Examining hardware and software wallets in a secure, controlled environment
Recovering and analyzing artifacts from seized digital devices
Reconstructing transaction graphs across UTXO and account-based chains
Address Clustering and Attribution
Common-input clustering techniques and other industry-standard heuristics
Detecting change outputs and identifying behavioral fingerprints
Linking on-chain entities to off-chain identities using Open Source Intelligence (OSINT)
Integrating web crawling, social media data, and leaked databases for attribution
Dark Web, Marketplaces, and Criminal Cryptocurrency Flows
Mapping criminal economies within dark web marketplaces
Common typologies: scams, fraud, contraband sales, and sanctions evasion
Tracking funds from initial deposit through final cash-out points
Identifying indicators of corruption-linked cryptocurrency activity
Privacy-Enhancing Tools and Counter-Forensics
Mixers, tumblers, and CoinJoin implementations
Privacy coins and the limitations of public-chain tracing
Cross-chain bridges and asset wrapping as obfuscation layers
Assessing what tracing techniques can and cannot recover under each method
Hands-On Lab - Tracing a Suspect Wallet
Utilizing open-source tools to follow complex transaction graphs
Clustering wallet networks and assigning confidence levels to attributions
Documenting findings as a structured intelligence package
Money Laundering Typologies in Crypto
Placement, layering, and integration processes adapted for digital assets
Layering techniques via decentralized exchanges, bridges, and mixers
DeFi protocols as laundering surfaces and methods for analysis
Cash-out vectors: peer-to-peer markets, OTC desks, and prepaid instruments
Ransomware, Theft, and Scam Response
Ransomware payment patterns and immediate incident response steps
Negotiation tactics and recovery practices, including associated limits and risks
Analysis of exchange hacks, rug pulls, phishing attacks, and large-scale thefts
Collaborating with victims to preserve evidence without compromising investigative integrity
Cross-Chain Investigation
Tracing assets across Bitcoin, Ethereum, and EVM-compatible chains
Following fund movements through bridges and wrapped tokens
Reconciling on-chain evidence with exchange records and off-chain data
Hands-On Simulation - Corruption Investigation Lab
A simulated bribery flow across multiple chains and a mixer
Constructing a coherent narrative from fragmented on-chain evidence
Generating chain-of-custody documentation for digital evidence
AML Compliance and the Legal Landscape
FATF guidance, the Travel Rule, and jurisdictional variations
AML and KYC obligations for Virtual Asset Service Providers (VASPs)
Sanctions compliance, politically exposed persons (PEPs), and corruption-relevant typologies
Integrating cryptocurrency findings into existing compliance frameworks
Working with Exchanges and Cross-Border Partners
Utilizing subpoenas, Mutual Legal Assistance Treaties (MLATs), and information-sharing channels
Obtaining freezing orders, asset preservation measures, and seizure procedures
Coordinating cryptocurrency tracing with traditional financial investigation lines
Digital Evidence and Courtroom Readiness
Establishing chain of custody for cryptocurrency artifacts and on-chain evidence
Presenting blockchain evidence effectively to non-technical decision-makers and juries
Addressing common challenges to digital evidence and defending investigative findings
Collaborating with expert witnesses and external technical advisors
Capstone - End-to-End Corruption Inquiry Simulation
Conducting a full investigation from initial intelligence tip to conclusion
Developing wallet networks, attributions, and timelines
Engaging with exchanges and cross-border investigative partners
Drafting a courtroom-ready report and delivering an oral briefing
Summary and Next Steps
Requirements
- Intermediate technical proficiency, including networking knowledge and basic Linux command-line operations
- Practical understanding of cryptographic principles, such as hashing algorithms and public-key encryption
- Professional background in financial investigation, cybersecurity, digital forensics, or regulatory compliance
- Prior familiarity with at least one programming or scripting language is advantageous but not mandatory
- General comprehension of financial transaction structures and AML regulatory principles
Targeted Audience
Investigators and forensic analysts employed by anti-corruption agencies, financial crime units, and law enforcement bodies. Cybersecurity professionals supporting fraud detection, AML initiatives, and digital evidence operations. Compliance and risk management specialists operating in regulated sectors where exposure to cryptocurrency-related risks is growing.
Testimonials (1)
- like the blockchain introduction. For a blockchain newbie like me, its englighten me. - Like the technical workshop, also interesting
