NESTED EXCHANGE PRACTICAL

On 2024-05-04, a victim was contacted by a scammer identifying himself as a U.S. Customs Agent.  The scammer told the victim that a package addressed to her residence was intercepted and contained illegal drugs. The scammer advised that a fine of $30,000 has been assessed and must be paid immediately to avoid her passport being revoked. The victim frequently travels back and forth between the United States and England and was fearful of losing her passport.  The scammer advised that the funds should be paid immediately at any Bitcoin ATM Machine and that she should send the payment to the following address:

14t1boHKexyqQvWqwBhFyM9Gv51Z4rL3uj

On 2024-05-04 18:52:59 the victim traveled to a Bitcoin ATM Machine and deposited approximately $30,000 USD sending the funds to the scammer’s address. The net transfer was 0.40669661 BTC with a USD value of $25,822.22.

Using an advanced analytical tool trace the address and identify the following information:

NOTE: CT Pro – Use the Tracer Feature

NOTE: All hops occurred within one to two days of the scam.

• Identify the name of the primary CEX Exchange the target may have used to cash out the cryptocurrency
   
• Identify Nested Exchanges that may be using an API Key from the Primary Exchanges
   
• Using open-source intel techniques, determine what customer information may be available from the Nested Exchanges that have a label of "Evidence of Ownership" in CT PRO.
   
• Based on the above information, what would the next investigative steps be?
   
• Document the last four of the transaction hash, the suspect address, and the exchange deposit address that you would use to prepare a Letterhead Memo to the exchange for account information.