Blockchain Assets: Identification, Analysis, and Review

© Relativity. All rights reserved.
Blockchain Assets:
Identification, Analysis,
and Review

© Relativity. All rights reserved. #RELATIVITYFEST
Joshua McDougallAssociate Managing Director, Cyber Risk
Joshua.McDougall@kroll.com
#RELATIVITYFEST

Agenda
• Presentation Outcomes
• Terminology
• Project Strategy
– Identification
– Preservation & Collection
– Review & Analysis
– Monitoring
– Production
• Conclusion & Continuations

Understand the basics of blockchain technology
Be able to identify when it may be involved
Understand new risks to your business and your client
Understand what public and private data is available
and how it can assist
Presentation Outcomes
#RELATIVITYFEST

Terminology
“After hearing about Bitcoin, I've installed a
Bitcoin client and bought 3 bitcoins. Now the network
forked and I don’t know what side of the blockchain
my wallet follows…”
#RELATIVITYFEST

a digital immutable ledger in which transactions made are
recorded chronologically and publicly.
Blockchain
Terminology
ELI5: Everyone can read and write on the same whiteboard, but
there are only permanent markers.

a type of digital currency in which encryption techniques are used to
regulate the generation of units of currency and verify the transfer of
funds, operating independently of a central bank. “Capital B” Bitcoin is
the protocol, the network, and the community.
Bitcoin
a unit of the Bitcoin currency.
bitcoin
Terminology

A blockchain wallet is used to secure, send, and/or receive digital currency
like Bitcoin. Wallets can take many forms including desktop applications,
mobile apps, third-party services, physical forms such as paper, metal, or
special devices, and even mental forms such as complex phrases.
Wallet
Terminology

Terminology
Currencies Smart Contracts Utility Tokens
Stablecoins Privacy Coins No Idea … Yet
??
?

Project Strategy
With so many new definitions, concepts, and
considerations, where do we begin?
#RELATIVITYFEST

Enter the same
strategy we all
rely on…
I’m sorry new EDRM overlords,
I hope this is cool…

Identification

Has the business or individual mentioned that digital
assets are involved?
Is there a suspicion of hidden assets?
Has any other evidence implied digital assets are
relevant?
Software Wallets, Browsing History, Communications
Ask!
Knowing When This Is Relevant
#RELATIVITYFEST

Identification – Early Case Assessment
https://Tokens.FYI

Preservation & Collection

What is it? / Where is it?
Preservation & Collection
The Asset The Blockchain
What is it? / Where is it?

• Assets are not held, they are assigned
• Can be assigned to one or more entities
(i.e. a ‘key’) at a time
• Can be assigned to “Anybody”
Ownership, Access, & Possession
• Distributed across the globe
• Open for all to download
• Several organizations writing software
(wallets, explorers, analytics, etc.)
• Does anybody ‘own’ the protocols we
use every day? HTTP, IMAP, SMTP, etc.

• You will not find a bitcoin on a machine
• You could find a secret (aka “private
key”) that authorizes changes to a digital
asset (such as change in ownership)
• You could also find lists of accounts,
addresses, wallets, transactions, and
third-party services
• Additional metadata could include details
related to the asset not publicly available
Ownership, Access, & Possession
• Has the complete list of actions and
transactions related to the digital assets
recorded on that network
• Can be explored through third parties or
downloaded and fully verified locally
• Details available will not be personally
identifiable without additional information

All Forms of
Wallets &
Private Keys

Did you think storing PII was scary enough?
#RELATIVITYFEST

Are you aware of “private keys” on a device / share?
Are you prepared to take on the responsibility of custodianship?
Are you sure that no other party has access to the digital assets?
Can your insurance still cover the loss of the asset if it was suddenly
worth 100x more than when originally collected?
Are you prepared to handle an infinite amount of assets with varying
worth and technical requirements that may be unknowingly
accessible by the private keys collected?
Overcollection Can Be Dangerous!
#RELATIVITYFEST

Review & Analysis

Although some aspects of an investigation can be fairly consistent, other factors may
depend heavily on the specifics of the case. Some common trails and tasks one could follow
in a blockchain related case include:
• Understanding how much an individual or organization holds
• Tracking where funds went
• Tracking where funds originated from
• Making connections between blockchain transactions and real-life exchanges
• Making connections between accounts/addresses and their true associations
• Analyzing network forks for additional assets
• Proving control/access to digital assets
• Valuating digital assets/portfolios
Review & Analysis

• Which addresses are related to the
wallet?
• What addresses has the wallet
interacted with (sending/receiving of
funds, interactions with contracts, etc.)?
• When was the wallet created?
• When was it last used?
• What other services were interacted
with?
Review & Analysis
• Did the custodian have accounts on
cryptocurrency exchanges?
– What is the trade history on the site?
• Did the user access online wallets?
• What related communities were they a
part of?
• Were any mixing services used?
• Did the custodian access dark markets?
Wallets Services

• Who all is involved in a transaction?
– Either the individuals, organizations,
services, or only as the pseudo-
anonymous addresses
• What connections can be made to real-
life transactions?
• Can analysis services provide extra
details relevant to the case?
Review & Analysis
• Who has control over an address?
– Either the individuals, organizations,
services
• What transactions are associated with an
address?
• What other addresses may be related?
• What type of address is it?
Transactions Addresses

Review & Analysis – Transaction Mapping Tools

Review & Analysis – Potential Documents Types and Content
• Communications
• Transaction Lists
• Wallet Lists
• Exchange Trading Data
• Privacy Coin “View Keys”
• Website Caches
• Bank Statements
• Calendar Entries
• Airlines and Hotel Itineraries

Review & Analysis – Keywords
https://Tokens.FYI

Monitoring

Since blockchains and the ecosystems surrounding them progress 24/7, it is important to
build a monitoring process into your workflow to ensure an understanding of the current
realities in each relevant chain. Assets held at the beginning of an investigation may differ
by the end, either via transactions altering the possession of assets, or through changes in
the technology/network.
• Assets may move
• New assets may be gained
• New information/metadata may be learned of addresses, accounts, or transactions
• The value of the assets may (will) fluctuate
Monitoring

Production

• Address Metadata
– Address
– Network (Bitcoin, Ethereum, etc.)
– Public Key
– Associated Contact / Custodian
– Analytics Information
• Transaction Metadata
– Transaction ID (TXID)
– Associated Contact / Custodian / Service
– Analytics Information
Production - Fields
• Current Wallet Value
• Ongoing Transaction History
Static Details Dynamic Details

• What is the best way to visualize much of this data?
– The geek in me finds this valuable, but something tells me a judge wouldn’t always agree
Production – I don’t have all the answers…

Exchanging Private Keys…
#RELATIVITYFEST

No Private Key Data
No Private Key Data
No Private Key Data
No Private Key Data
Production QC Checklist
#RELATIVITYFEST

Conclusions
& Continuations
If you leave this presentation with more questions than
answers, but the curiosity to dig deeper, we’re on the
right track.
#RELATIVITYFEST

Conclusions
Blockchain technology and cryptographically-backed
digital assets are new, but cases involving them still
require the same strategy outlined by the EDRM.
The collection and storage of digital asset private keys
can bring risk beyond that of PII to our firms.
Check out https://Tokens.FYI for up-to-date keywords.
Consider running them as part of your ECA strategy
#RELATIVITYFEST

Continuation
The tools for these investigations are still immature, if
existent at all.
Similarly, the standard procedures and policies are still
in development and debate—especially around how to
protect your firm, client, and the opposing side—
around the new risks faced by each.
This poses an exciting opportunity to contribute to the
direction driven by these changes.
#RELATIVITYFEST

Blockchain Assets: Identification, Analysis, and Review

More Related Content

What's hot (20)

Similar to Blockchain Assets: Identification, Analysis, and Review (20)

Recently uploaded (20)

Blockchain Assets: Identification, Analysis, and Review

Editor's Notes