For investigation of cryptocurrency frauds and financial crimes, we believe every effort must be made to report findings in a manner that is comprehensible to a layperson. It can be challenging to convey technical and cryptographic concepts in the plainest language possible — but you cannot persuade a judge or jury if they don’t understand what you’re talking about.

Effective communication in complex cases begins by establishing clear, standardized definitions for common terms. Below is a glossary developed by the investigative staff of Hudson Intelligence for cryptocurrency casework. We are sharing this internal reference in hopes it may serve as a useful guide for attorneys, investors, regulators and law enforcement.

Like everything else about cryptocurrency (including its case law, tax treatment and regulatory framework…) this remains a work in progress.

John Powers, CFE, CTCE
Cassia Mangin, CFE, CTCE

 


Address is a string of letters and numbers – a unique alphanumeric sequence – that serves as the virtual location to which digital currency is sent and received.

Address is a shortened version, or hash, of a public key. Public key is one part of the cryptographic pair that controls the asset. A private key, or password, is also required to access or transfer the cryptocurrency stored at each address.

Here is a Bitcoin address: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa. An address is sometimes compared to an account number, although this analogy is imperfect. For example, addresses are publicly listed on the blockchain ledger, whereas most financial account numbers are not published online. Many privacy-minded users discard addresses after a single transaction, making it more difficult to trace their activity through the blockchain.

Self-custodial addresses are directly controlled by their owners through a wallet. Exchange addresses are controlled by commercial exchanges. Deposit addresses at exchanges are generally reserved for exclusive use by a particular customer.

Address Reuse reduces privacy and anonymity, and can reveal multiple cryptocurrency addresses controlled by the same person. (Learn More.)

Altcoin, or alternative coin, is a general description for any cryptocurrency other than Bitcoin (and, for some, Ether), such as Litecoin, Bitcoin Cash and Monero.

Binance (Binance.com) is the largest commercial exchange worldwide in terms of trading volume. Operated by Binance Holdings Ltd., it was initially based in China but is now domiciled in the Cayman Islands. Its affiliated United States exchange platform (Binance.US) is operated by BAM Trading Services Inc. of San Francisco, CA.

Bitcoin (BTC) is a digital currency that is generated, transacted and controlled through computer applications operating across a decentralized, international, peer-to-peer network. It does not have a central administrator and is not issued under the authority of any government, bank, or company. Bitcoin was invented over a decade ago and remains one of the most popular types of cryptocurrency.

Blockchain is a cryptographic database that stores, shares and replicates information in blocks of data, which are chained together in chronological order.

Cryptocurrency transactions are recorded on a blockchain. The blockchain contains a permanent, immutable record of every transaction, stored across a decentralized network. It visible online to everyone. The blockchain for Bitcoin identifies participants by a cryptocurrency address associated with a specific asset – such as 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa – but does not provide names, locations, private keys, or other personal identifiers.

Blockchain Explorer is an online application that allows users to browse and search transactional details published on a blockchain.

Change Address is used when someone sends more Bitcoin than the amount due for a transaction. A separate address belonging to the sender, known as the change address, is used to receive the balance of unspent funds.

If you send 1.00 BTC for something that costs only 0.75 BTC, you will receive 0.25 BTC at a change address (less any transaction fees).

This is similar to using a dollar bill to pay for a 75-cent snack at the corner store, and receiving a quarter in change.

Typically, a new change address is created for each corresponding transaction. However, it is possible in certain applications to direct the change to an existing address in the sender's wallet.

Cluster is a group of cryptocurrency addresses that are controlled by the same person or entity. Cryptocurrency investigators utilize a variety of research methods, proprietary algorithms and forensic tools for data attribution and clustering analysis.

Coinbase is the largest U.S. exchange in terms of trading volume. It is operated by Coinbase Inc., a wholly owned subsidiary of Coinbase Global Inc., which has a number of other operating subsidiaries worldwide.

CoinJoin is a privacy-enhancing Bitcoin transaction which combines inputs from numerous users and returns multiple outputs of identical values. (Learn More.)

Common Spend is an element of heuristic processes, or methods, used by blockchain analysts to identify other cryptocurrency addresses controlled by the subject of an investigation. (Learn More.)

Cryptocurrency is a virtual currency that relies on cryptography to securely process financial transactions, verify transfers of assets, and create new units of exchange commonly referred to as ‘coins.’

Darknet Market is a website that facilitates the sale and exchange of illicit goods and services on the dark web. (Learn More.)

Dark Web is an anonymized overlay of the internet, accessible through networks such as Tor ("The Onion Router"), I2P and Riffle that utilize layered encryption to obscure the identities and locations of users. (Learn More.)

Deep Web is the portion of the internet that is not indexed by standard search engines, in contrast to the ‘clear net’ most consumers are accustomed to searching through Google or Bing. (Learn More.)

Digital Currency is money in electronic form. It includes virtual currency and cryptocurrency. Digital currency can also represent regulated fiat, such as when services like Paypal and Venmo are used to send, receive or hold funds.

Distributed Ledger Technology (DLT) is a consensus-based ledger system with an audit trail maintained and validated by nodes. It can be decentralized or centralized. The Bitcoin blockchain is an example of a distributed ledger stored across a decentralized network.

Ethereum is a decentralized, open-source network for digital assets, including its native cryptocurrency, Ether (ETH), and numerous other blockchain-compatible tokens. Ethereum also functions as a platform for developing decentralized applications. It was released in 2015 and features more sophisticated blockchain technology than Bitcoin.

Ethereum facilitates the development of alternative tokens through its technical standards, including ERC-20 (fungible tokens) and ERC-721 (non-fungible tokens).

There are hundreds of thousands of compatible tokens on the Ethereum network, which has emerged as the leading platform for Initial Coin Offerings (ICOs) and Initial Token Offerings (ITOs).

The Ethereum platform enables developers to write decentralized applications (dApps) hosted on the blockchain. These programs, known as contracts, can perform complex computational functions.

Ethereum generally facilitates transactions between two addresses, although a single contract can trigger multiple transactions.

Ether (ETH) is the native cryptocurrency of the Ethereum platform.

Exchange is an online platform for trading cryptocurrencies, tokens and digital assets. Major commercial exchanges such as Binance and Coinbase facilitate the purchase and sale of digital assets using dollars, euros, and other government-issued (fiat) currency. Other exchanges do not accept fiat currency, and solely facilitate trades and swaps of cryptocurrencies and tokens.

Fiat is a traditional type of currency issued through a central banking authority and produced in physical notes and coins. The U.S. dollar is an example of fiat currency.

Fiat is commonly used to distinguish government-issued paper currency from cryptocurrency.

Cryptocurrencies like Bitcoin and Ethereum are non-fiat currency. Their value is determined by popular consensus, with monetary supply regulated by cryptographic protocols and computer nodes in a decentralized network. These virtual currencies are not produced in physical form, and exist outside the control of any sovereign state.

The Latin word fiat means “let it be done” and signifies an edict by authority. In the context of money, this term was originally used to describe currency that derives its value from the economic stability of the issuing government, rather than being backed by any commodity.

The U.S. dollar became a fiat currency when the United States abandoned the gold standard. This process began during the Great Depression after President Herbert Hoover declared, “We have gold because we cannot trust governments.” Congress passed a resolution voiding the right of creditors to demand payment in gold in 1933, but the fixed-rate convertibility of dollars for gold did not fully cease in international currency markets until 1971.

High Risk Exchange is a virtual asset service provider characterized by a general lack of legal and/or regulatory compliance. Common regulatory lapses include failure to verify customer identities; refusal to comply with subpoenas; and failure to monitor transactions for criminal, fraudulent, or sanctioned activity. (Learn More.)

Initial Coin Offering (ICO) or Initial Token Offering (ITO) is an investment offering in which private companies raise funds by issuing and selling new cryptocurrency coins or tokens to investors.

ICOs have been used to successfully raise capital for technology firms and other startups. They are an alternative to raising funds through more traditional channels of investment banking, venture capital, or an initial public offering (IPO) of corporate securities.

However, fewer than half of all coins and tokens issued through ICOs retain value for more than six months, according to some estimates.

These highly speculative offerings have also become a platform for investment fraud and Ponzi schemes. Numerous ICO fraud schemes have been exposed in enforcement actions by the U.S. Securities and Exchange Commission (SEC) and Federal Bureau of Investigation (FBI). (Learn More.)

Layering is a technique for obscuring the origin and destination of illicit funds by adding extra levels of complexity to the transaction trail. It is often used as a form of money laundering. (Learn More.)

Mining is the process of creating new crypto coins by solving cryptographic equations. The process involves verifying transactions and adding transaction records to the distributed public ledger, or blockchain. Mining requires powerful computer systems and often consumes massive amounts of energy. The computer systems may also be linked in groups known as mining pools.

Mixer is an online service that pools cryptocurrency funds from multiple users, and generates outputs in different amounts, to obscure the auditable trail of the funds. (Learn More.)

Monero (XMR) is an open-source privacy coin with a partially obfuscated public ledger that uses stealth addresses and ring signatures to conceal the source of transactions. It is promoted with a claim of being “untraceable.”

Non-Fungible Token (NFT) is a unique cryptographic token that exists on a blockchain and cannot be duplicated, replicated or replaced. Ownership of real-world and digital assets can be represented by NFTs through a process known as tokenization or minting, which enables the underlying assets to be bought, sold and traded through blockchain-based financial transactions.

An NFT is similar to a certificate of ownership. However, the specific rights conveyed to the NFT holder may differ depending on the terms of the smart contract. For instance, an artist who creates an NFT of their digital artwork might retain commercial rights to the underlying artwork after the NFT has been minted and sold.

NFTs are significantly different than fungible tokens and cryptocurrencies – like Tether (USDT), Ether (ETH) or Bitcoin (BTC) – in which each token/coin is interchangeable with others of the same kind. One USDT token, for example, is worth the same as any other USDT token, in the same manner that the unit of value represented by one U.S. dollar bill is equal to any other U.S. dollar bill.

Node is the name for computers across the blockchain network that validate and relay transactions. Nodes store a copy of the blockchain.

Peel Chain is a technique to launder a large amount of cryptocurrency through a lengthy series of small transactions. (Learn More.)

Peer-to-Peer Exchange, or P2P Exchange, is an online platform for people to buy, sell and trade cryptocurrencies with each other directly (and more or less anonymously). (Learn More.)

Privacy Coins are alternative cryptocurrencies designed with special features to strongly protect user anonymity and transactional confidentiality, making them more difficult to trace by law enforcement and blockchain intelligence analysts. Privacy coins include Monero (XMR), Zcash (ZEC), Dash (DASH), Horizen (ZEN) and Verge (XVG).

Private Key is a cryptographic password. It is part of the cryptographic pair that controls access to cryptocurrency assets. The other part is the Public Key, which is non-private and published on the blockchain in a shortened version, or hash, known as an address.

The private key allows the user to access and transfer the cryptocurrency associated with that address. In general, only the owner of each cryptocurrency asset should have access to its private key. However, online hacks and security lapses have made some keys vulnerable to theft, and billions of dollars in cryptocurrency have been stolen by cybercriminals.

Protocol is a set of rules that dictates how nodes verify and record transactions. Protocols may be periodically modified and upgraded.

Bitcoin (BTC) protocol upgrades include Taproot (P2TR) in November 2021 with enhanced privacy and multi-signature (multisig) transaction capabilities. This follows the Segregated Witness (SegWit) upgrade in 2017, which was intended to improve scalability by increasing the number of transactions in any BTC block. Addresses on the SegWit soft fork are 42 characters in length and start with “bc1”.

Pump and dump schemes are a form of investment fraud in which unscrupulous promoters “pump” the stock of an altcoin or crypto token with false and misleading statements about potential returns. The sales pitches often come in unsolicited emails, social media posts, messaging apps, online forums or cold calls. (Learn More.)

Seizure is a legal mechanism for forfeiture of property associated with the commission of a crime. Seizure warrants have been obtained by federal prosecutors to recapture cryptocurrency proceeds from cyberattacks, ransomware, terrorist financing, money laundering, and other criminal violations. U.S. courts have exercised authority to issue seizure orders against Bitcoin and cryptocurrency addresses, but successful recovery ultimately depends on the accessibility of private keys that control those assets.

Smart Contract is a computer program – containing code and data – that resides and runs on a blockchain. Each smart contract has its own unique address on the blockchain.

Smart contracts are a core component of the Ethereum platform, which offers this description: “Smart contracts are a type of Ethereum account. This means they have a balance and they can send transactions over the network. However they're not controlled by a user, instead they are deployed to the network and run as programmed. User accounts can then interact with a smart contract by submitting transactions that execute a function defined on the smart contract.”

Stablecoin is a type of virtual currency intended to maintain a consistent value. Tether (USDT) is an example of a stablecoin, designed to keep its value pegged at one U.S. dollar. Minimal price volatility of stablecoins stands in contrast to other cryptocurrencies, such as Bitcoin, with values that fluctuate substantially over time.

Token is a virtual asset on a blockchain. A distinction can be made between coins that serve as the native currency of a blockchain, and tokens developed as alternative assets on that blockchain. Hundreds of thousands of various tokens have been issued on the Ethereum platform, for example, which also has its own native cryptocurrency, Ether (ETH). Tokens commonly follow the same rules and technical standards established for their blockchain network. New tokens can be promoted and sold to investors through Initial Token Offerings (ITOs).

Tokenization is the creation of virtual assets on a blockchain that represent company shares, commodities, fine art, real estate, or other tradeable assets.

Transaction Hash is a unique identifier for a specific transaction on the blockchain. The transaction hash (Tx ID) can be entered into a blockchain explorer to review the cryptocurrency addresses, data, date, and time stamp of a particular transaction.

Unspent Transaction Output (UTXO) is the amount of Bitcoin that remains after making a transaction.

UTXOs cannot be subdivided into smaller pieces before a transaction. Instead, the entire value must be spent in a transaction, and any remaining balance (if the amount sent exceeds the amount due) is returned as UTXO to a change address. This output can then be used as the input, or payment source, for the next transaction.

Think of it this way: You don't tear apart a dollar bill to buy a pack of gum. You hand over the entire note, and in return, receive a small amount of change. A dime, maybe. You can now use that coin to buy something else.

In this accounting model – used by blockchains of Bitcoin, Litecoin and Dogecoin, among others – existing UTXOs are continually being consumed in transactions that produce new UTXOs in their place.

By comparison, a number of other blockchains, such as Ethereum, use an account-based model with account balances that can be partially spent.

Virtual Asset Service Provider (VASP) is a service that facilitates conversion of fiat currencies and virtual currencies; or transfers virtual assets for its customers; or allows its customers to exchange different forms of cryptocurrency. These include major commercial exchanges, such as Coinbase and Binance, as well as Bitcoin ATMs, peer-to-peer exchanges, and alternative trading systems. VASPs can include entities that solely provide crypto-to-crypto conversion, without any exchange of fiat currency or other commodities. They also include businesses that provide custodial services and administration of virtual assets, or provide financial services related to the offer and sale of virtual assets.

Virtual Currency is a type of digital currency that is only available in electronic form and does not represent regulated fiat currency. Unlike traditional government-issued currencies like the dollar or euro, virtual currency is not produced in any physical form such as paper bills or minted coins. Cryptocurrency is a form of virtual currency.

Wallet is an application, service or device that holds its user’s public keys and private keys. A wallet can be used to store and control digital assets associated with multiple addresses (public keys) and operate their private keys as needed to interface with the blockchain and execute transactions.

There are hot wallets and cold wallets. A hot wallet is connected to the internet, making it easier to use but more vulnerable to password hacks and cryptocurrency theft. A cold wallet stores cryptocurrency offline, on hardware or paper, for an additional level of security.

Wallet Scoring is a type of cryptocurrency risk assessment commonly conducted for regulatory compliance and forensic analysis.

Automated risk-scoring of wallets is performed by blockchain intelligence tools. Applications from firms such as Chainalysis, CipherTrace and Elliptic use advanced algorithms to trace activity of target address(es) and identify any associations with known clusters, counterparties or entities such as exchanges, mixers, or darknet markets. The relative value of such associations are weighed against risk rules that prioritize specific legal and compliance concerns. The wallet receives a numerical risk score from 1 to 10.

Predictive risk ratings produced by these algorithms are based solely on discernible activity, and may not accurately reflect all relevant interactions, because the vast majority of cryptocurrency addresses remain anonymous.

Additionally, the attribution of certain activity may relate only indirectly to the wallet’s owner, or it might be mischaracterized if the context of a transaction cannot be discerned. For instance, an address used by victims of an extortion scheme could potentially be characterized as “high risk” if used to make a payment to a known ransomware group. In this circumstance, the application correctly identifies a direct link between the victims and the criminal scheme, but cannot discern or differentiate the nature of that connection.

Although risk assessment may be limited in certain cases due to lack of available data, wallet scoring remains highly effective for flagging addresses associated with criminal clusters and sanctioned entities. It is an important component of KYC/AML compliance and investor due diligence.


Consult an Investigator

Hudson Intelligence assists law firms, businesses, public agencies and investors with cryptocurrency investigations and due diligence. Every investigation is led by a Cryptocurrency Tracing Certified Examiner (CTCE) and Certified Fraud Examiner (CFE). If you would like to discuss a potential investigation, please complete the form below. We also suggest reviewing our FAQ.