As incidents of cyber attacks continue to rise and the industry grapples with the associated ramifications and risks, the need for education and certifications is more vital than ever.  One such certification, the designation of Certified Cryptocurrency Forensic Investigator (CCFI), is the first and only certification program that focuses solely on cryptocurrency investigations.  But what does this mean in the “real world?”

The CCFI designation attests that investigators have the knowledge, skills and expertise necessary to investigate cyber incidents where cryptocurrency is a component of the crime.  Essentially, the training provided by the certification program arms investigators with additional skills to utilize forensic evidence found within cryptocurrency keys and digital wallets to strip away the often-nefarious anonymity associated with cryptocurrency.  This information is used to help provide “attribution,” determining who may be behind the attack.  This information also is important because it reveals details about attackers’ methods, skills, previous tools and motivation, which is vital to both the investigation and to remediating damages inflicted during an attack.  This attribution helps to determine the “who” and the “why” of an attack, and the remainder of the investigation determines the “what,” “when,” “where” and “how.”

According to Statista, there were more than 300 million ransomware attacks during 2020, each involving or related to cryptocurrency.  The skills associated with the CCFI certification provide first responders and investigators with additional vital tools for their investigations, and the specific data they uncover around cryptocurrency can directly help law enforcement seize and return stolen funds.  If an attacker’s private “key” can be discovered during an investigation, their digital wallet, containing their crypto-assets, can be seized by law enforcement.  Currently, there are more than 453,000 confiscated digital assets in the world, including 63.7 in bitcoin (worth approximately $2.3 million) seized by the FBI in their investigation of the recent Colonial Pipeline ransomware attack.

CCFI training ensures that any investigation, whether criminal or civil, is handled properly when cryptocurrencies are involved, following proper rules of evidence—those which are specific to each jurisdiction.

In litigation cases, investigators can assist with discovery and analysis of such crypto-assets as wallets, tokens and smart contracts, including the off-line preservation of cryptocurrencies as warranted.  As cryptocurrencies continue to enter the mainstream, eDiscovery engagements are expected to increasingly involve some component of cryptocurrencies.  To meet this growing need, investigators must be able to identify cryptocurrency usage that users may try to conceal.  CCFI training ensures that any investigation, whether criminal or civil, is handled properly when cryptocurrencies are involved, following proper rules of evidence—those which are specific to each jurisdiction.

Investigators with the Certified Cryptocurrency Forensic Investigator certification bring a unique set of skills to bear in the course of an engagement that involves cryptocurrency, supplementing the skill base of a traditional forensic investigation to ensure that engagement can keep up with the ever-changing landscape of cryptocurrency, blockchain and smart contracts.

This article is courtesy of HKA Global, the world’s leading consultancy of choice for multi-disciplinary expert and specialist services in risk mitigation and dispute resolution. We employ more than 1,000 consultants, experts and advisors in more than 40 offices across 17 countries. Our team has extensive experience advising clients on the economic impact of commercial and investment treaty disputes, forensic accounting matters and in cybersecurity and privacy governance and compliance. HKA also supports companies that conduct business with the US Federal Government, providing consulting services on complex government contracting matters.

The information provided in this article is intended for general educational purposes only—it does not constitute legal, accounting, insurance, or other professional advice, and it should not be relied upon as the basis for your business decisions.