Illicit-Activity Typologies
Free Chainalysis Cryptocurrency Fundamentals Certification practice — 6 questions on Illicit-Activity Typologies, with explanations. No sign-up. Full 12-question mixed test →
An investigator reviews a case where the victim was contacted online by a stranger who spent several weeks building a personal relationship before introducing a 'guaranteed high-return' crypto trading platform. The victim deposited funds over several months, watched fake profits accrue on a spoofed dashboard, and was ultimately unable to withdraw any funds. On-chain, the deposit address received funds from dozens of similar victims before rapidly consolidating and cashing out through a chain of intermediary wallets to a single exchange deposit address. Which illicit-activity typology does this scenario BEST describe?
The scenario matches the defining features of pig butchering: prolonged relationship-building ('fattening the pig'), a fraudulent investment platform showing fake returns, and funds funneled from many victims into shared collection wallets before cash-out.
A ransomware affiliate receives a Bitcoin ransom payment. The affiliate immediately swaps the BTC for Monero using an instant-exchange service, holds the funds for several weeks, then swaps the Monero back into Bitcoin and deposits it at a mainstream exchange. Which laundering technique does this scenario illustrate?
Chain-hopping refers to moving value across multiple blockchains or asset types (here BTC to XMR and back to BTC) to break the on-chain trail, exploiting the difficulty of tracing through a privacy coin and cross-chain conversions.
Blockchain analysts observe that proceeds from darknet market vendor sales are frequently deposited into wallet clusters that ultimately settle inside the address space of a single large, licensed exchange, despite the vendor never completing that exchange's own KYC process. Which type of service is most likely facilitating this cash-out?
A nested exchange is a smaller business operating on top of, or inside, a larger exchange's omnibus wallet infrastructure, often with weaker KYC controls, letting customers transact without directly onboarding with the parent exchange — a common darknet market vendor cash-out route.
An attacker steals funds from a DeFi protocol exploit. Analysts trace the stolen funds through a rapid sequence of more than 50 wallets, where at each hop the vast majority of the balance is forwarded to the next wallet and only a small amount is split off, until the funds reach a mixing service. Which laundering technique does this pattern describe?
A peel chain is a sequence of transactions in which a small amount is 'peeled off' at each hop while the bulk of funds continues moving forward through many wallets — a classic technique used to complicate tracing before reaching a cash-out point such as a mixer.
Which of the following best describes a terrorism-financing typology commonly identified through blockchain analysis?
Terrorism-financing campaigns frequently rely on public solicitation across social media and messaging apps, collecting many small, low-value donations from a broad donor base that are consolidated on-chain before cash-out — a pattern distinct from a single sanctioned transfer or a DeFi exit scam.
A user intends to send funds to an address they used previously. They copy what appears to be that same address from their wallet's transaction history, but the funds are instead sent to an attacker-controlled address that shares identical first and last characters with the legitimate one. Which typology does this describe?
Address poisoning involves an attacker sending a small or zero-value transaction from a lookalike address (matching the first and last characters of a legitimate one) into a victim's transaction history, hoping the victim later copies the wrong address and sends funds directly to the attacker.
Ready for the real thing?
The full course has two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed answer explanations.
Start my full course on Udemy →