1. TEST PAYMENT

On March 26, 2024, an undercover officer arranged for the purchase of 1 ounce of powder cocaine. The target wanted          to be paid in Bitcoin. The target provided the following address, and the undercover officer sent a $6.00 test                          transaction.

                  bc1qyqplled5djehv86lkazlrw47vnht3q65la4927

•  Using the Tracer feature of CT PRO, identify if the target address is associated with an exchange. If so, what is the name of the exchange?

2. MULTIPLE EXCHANGES TRACE

On February 22, 2025, at approximately 18:22 hrs, an undercover officer purchased a small quantity of meth from a target using Bitcoin. The undercover paid approximately $184 dollars and advised that .0019 BTC to the target who was using Bitcoin Address:

                      bc1q4ezjk74c4v0fkdfu3ent4fy46h4ak8hx9s6mtk 

During the undercover transaction, the target advised that he used multiple cryptocurrency exchanges to cashout his proceeds and he often transferred the cryptocurrency within a few days of being paid.

Using an advanced analytical tool, attempt to identify two-three exchanges the target may be using to liquidate the cryptocurrency. (NOTE – ALL TRANSACTIONS OCCURRED BETWEEN FEBRUARY 22-26, 2025)

3. MONEY PICKUP PRACTICAL

On 2021-07-02 20:06:24 an undercover officer assisted an International Drug Cartel launder approximately $101,125 USDT on the Tron Blockchain by sending $101,125 USDT to the Drug Cartel Mule. The Drug Cartel Mule provided a Tron Address of: NOTE (CT PRO SELECT THE TRON BLOCKCHAIN)

TFJdrtS8a5EGGLM4146QPKfoPEqsNT4kWv

Approximately 30-45 minutes after receiving the USDT from the undercover officer, the Drug Cartel Mule engaged in a wallet hop. NOTE: THE UNDERCOVER OFFICER TRANSACTION OCCURRED AT 2021-07-02 20:06:24

• Trace the address to a possible exchange used to liquidate the cryptocurrency. During the undercover operation, the target advised the UC that he successfully laundered and liquidated the cryptocurrency on July 3, 2021.

          NOTE: CT PRO - set a date filter of July 2 - 3, 2021 and select "TRON" Blockchain
 

• Based on the Exchange identified, document the transaction hash, the suspect address, and the exchange deposit address that would be put into your agency Letterhead Memo. 

BONUS PRACTICAL

On June 5, 2025, your cyber crimes unit received a Suspicious Activity Report (SAR) from Block, Inc. (Cash App) stating the following:

Block, Inc. ("Block") is filing Suspicious Activity Report ("SAR") ID: 542F5218EE for activity indicative of online child sexual exploitation ("OCSE"), specifically the purchase of child sexual abuse materials ("CSAM") conducted through Bitcoin ("BTC") withdrawals on the Cash App platform. The suspicious BTC withdrawals totaled $249.03 and took place between 04/22/2025 and 05/07/2025. NAME REDACTED ("Johns") with associated account C_REDACTED was identified as the subject in this matter for the potential purchase of CSAM. Block provides a money transmission product for non-commercial and commercial use known as Cash App. A Cash App account allows an individual to conduct electronic money transfers, funded by a linked debit card, bank account, credit card, physical cash or stored balance to other individuals and businesses. 

Cash App users may also use funds to purchase or sell BTC and transact with other Cash App users peer-to peer, or with external users via transactions on the blockchain or via the Lightning Network ("LN"), which is a second layer technology for faster BTC transactions. Analysis of the subjects activity discovered that between 04/22/2025 and 05/07/2025, Johns made (7) BTC withdrawals totaling $249.03 to several wallet addresses identified by third-party blockchain forensic tools (TRM Labs and Chainalaysis) to be associated with OCSE/CSAM. bc1qwpd2rw2uscyvxg5ls5kvn3ax32vdq300fkyc3l ("bc1qwpd2") Identified by Chainalysis as "Child Abuse Related bc1qpww5nl"

Based on the repeated withdrawals to wallet addresses associated with OCSE/CSAM, it appears these transactions are intended to purchase CSAM. The subjects remaining account activity was reviewed and no additional related suspicious activity was identified. The internet protocol ("IP") addresses utilized by the subject to conduct the suspicious withdrawals are listed below: 107.123.53.50 accessed by Johns on 04/21/2025 The reported accounts linked various bank accounts and credit/debit cards such as Visa Debit Card ending in #7596 at The Bancorp Bank, Visa Debit Card ending in #8613 at PNC Bank, and bank account ending in #9963 at The Bancorp Bank. Additional link attempts are available upon request. 

Open-source information indicated that Johns is a registered sex offender and was previously charged with "PANDERING SEXUALLY ORIENTED MATTER INVOLVING MINOR". In summary, due to the subjects BTC withdrawals with direct exposure to multiple CSAM-related clusters, the activity is tied to the FinCEN advisory OCSE-FIN-2021-NTC3 and CVC FIN-2019-A003. As a result of this suspicious activity, the subjects Cash App account was closed. 

Supporting documentation is attached to this report, case #542F5218EE. For additional information regarding this case, and to reach Block's Investigations team directly, please email siusupport@squareup.com

Based on this information, answer the following questions using an advanced blockchain analytical tool: 

1. Document the investigative steps you would take to validate the intelligence provided by Cash App.
    

      2. Based on the informatoin provided, is there probable cause to arrest "Johns" for CSAM violations?

      3. Using an advanced blockchain analytical tool, trace the BTC address (bc1qwpd2rw2uscyvxg5ls5kvn3ax32vdq300fkyc3l)  provided by Cash App to attempt to identify a possible centralized exchange or decentralized exchange used by alleged distributor of CSAM material.
 

Document the last four of the transaction hash, the target address, and the exchange deposit address that you would use to prepare a legal process to the exchange for account information.