Course Catalog

• Compare crypto crimes reported by victims vs. agency self-generated cases.
• Examine the purpose of the “Dark Web” and how bad actors exploit it.

• Distinguish the differences between tracing cryptocurrency using an “open source blockchain explorer” vs. a “paid digital forensic tool.”
• Demonstrate how to trace a wallet address using a “Transaction Hash.”

• Explain the different methods of freezing cryptocurrency and the importance of speed when tracing and freezing stolen digital assets.
• Evaluate law enforcement’s different tools for freezing, seizing, and forfeiting cryptocurrency from suspects’ wallets and accounts.

• Describe the process of seizing crypto assets through the local and state processes.
• Explain the three federal forfeiture options: Administrative, Civil Judicial, and Criminal.
• Compare the differences between seizing and forfeiting crypto assets through the local/state process and the federal process.

• Explain the five steps investigators must take to successfully return cryptocurrency to their victims.
• Evaluate the importance of having WAVE’s WatchTower platform available to local, state, and federal agencies and how this tool can assist these agencies with maintaining a clear and understandable ledger of their seized digital assets.

• Explain what local, state and federal law enforcement agencies can do to improve training for crypto fraud.
• Discuss the importance of crypto asset investigators in curtailing significant global criminal operations.

Module two focuses on discussion and brainstorming activities to plan and organize investigative methods in response to Dark Web markets. Specific focus is given to creation of a defined process of “de-anonymization.”

This module introduces students to the role of cryptocurrency on the Dark Web and how suspects plan criminal operations using cryptocurrency. This section involves not only using crypto to profit from using cryptocurrency but also how cryptocurrency can be used to launder the proceeds of dark web transactions.

In this module students are introduced to the data involved in cryptocurrency transactions and how that data can be analyzed. Additional focus is given to how the transactions can be connected to Dark Web use and activity.

Students are introduced to various open source tools and how to gather intelligence and information related to Dark Web Markets and surface web mirrors. The collection of this data can be used as evidence to build criminal cases seeking prosecution or furthering intelligence towards national security measures.

Module six involves a similar approach to module five and works to make the connections from the dark web markets to the cryptocurrency transactions. These investigative methods effectively move the investigation further and continue to develop intelligence. Additional focus is given to effectively articulating the investigative process to present strong cases for court and effective witness testimony.

Students are introduced to commercial cryptocurrency tracing tools like Lukka Investigator and Blockchain Intelligence Group QLUE for crypto tracing investigations. With these tools, students apply all previously learned investigative and intelligence driven methods using the tracing tools.

Students will discuss intelligence collection methods through open sources for crypto attribution. Attribution is a critical part of digital asset investigations. Attribution tells investigators where to go for the next stop in the investigations where evidence can be found. Without Attribution, there are only random letters and numbers associated with digital asset wallets. There is a specific process related to the application of intelligence methods in order to obtain attribution.

Students will identify intelligence analysis methods for cryptocurrency attribution. The key to attribution is the intelligence and intelligence is most effective and reliable when there is a specific process in the analysis of the intelligence. Students will learn to apply investigative methods that articulate their findings in a repeatable process which leads to the ability to validate findings and further criminal investigations and intelligence.

There is a unique approach to intelligence involved in digital asset and cryptocurrency investigations. Students will apply attribution methods to intelligence collected from open sources and develop their own Attributions Intelligence Rating System.

When it comes to digital asset and cryptocurrencies, they are all made possible through a public blockchain that offers no expectation of privacy. The blockchain is open to everyone, including law enforcement. It is the perfect example of open source intelligence. In module five, Students will discuss and identify public blockchains related to digital assets and how they offer open source intelligence for investigations.

Students will examine various open source tracing and investigative tools used to further digital asset investigations and intelligence. This module will also help students prepare for vendor certification in the different tracing tools.

Students will apply methods of HUMINT and CyBINT to OSINT investigations involving with digital assets and cryptocurrencies. This module looks to bring together all learned investigative and intelligence methods. A scenario based mock investigation and intelligence operation is designed for students to demonstrate their knowledge of investigative methods as applied to digital asset investigations.

• Discuss the uses cryptocurrency can have for international criminal organizations.
• Explain how criminal organizations using cryptocurrency can affect national security.
• Examine methods used by governments to restrict criminals from exploiting anonymity with their use of crypto.

• Explain the blockchain’s ability to create a layer of anonymity for users.
• Illustrate how the blockchain works and the method it uses to keep a ledger of all transactions.
• Illustrate how cold, hot and paper wallets work.
• Examine the Dark Web and how cryptocurrency is used to further criminal activity.

• Discuss the “Dark Web”, “Darknet”, and TOR “The Onion Router” and how terrorists take advantage of using the Dark Web.
• Explain how cryptocurrency is illegally used on the Dark Web and how 18USC1960 can help prevent these crimes.
• Examine how Tumblers/Mixers, funnel accounts, and the lack of regulations can further illegal crimes such as child exploitation, drug & human smuggling and terrorism, via the Dark Web and cryptocurrency.
• Discuss the benefits vs the risk with the lack of government and LE involvement in the crypto world and what effect that can have on terrorist organizations.

• Summarize the current crypto regulator oversight.
• Explain how more crypto oversight may or may not be beneficial to combat terrorism.

• Discuss the best practices for law enforcement with investigating cryptocurrency crime.
• Explain the different methods of freezing, seizing and forfeiting cryptocurrency within the local, state and federal agencies.
• Describe what tools forensic analyst and law enforcement officers can use to investigate crypto crime via the Blockchain.

• Explain what local, state and federal law enforcement agencies can do to improve training for crypto fraud.
• Discuss the importance of crypto asset investigators in curtailing significant global criminal operations.