Technical, forensic and organisational aspects of work with Monero cryptocurrency

Abstract

The forensic, organisational and technical features of law enforcement agencies' work with the Monero cryptocurrency in the context of pre-trial investigation and operational search activities are analysed. The development of the Monero system is described. The reasons and trends of Monero use by offenders are identified, and the scheme of operation of this payment system, which ensures its increased confidentiality, is shown. Examples of criminal offences in which Monero is used are presented. The functionality of OpenAlias to facilitate the work with Monero addresses is disclosed. The possibility of identifying participants in Monero transactions is studied. It is stated that there are currently no effective ways of such identification without knowledge of the public address and the corresponding keys, especially if users use additional security mechanisms such as connection to the TOR network.
 The features of forensic investigation of computer equipment used to work with Monero are revealed. It is established that the most effective is the study of traces of work with Monero, which are removed from the relevant computer equipment of the person of interest. Useful information can be stored in RAM, on a disc, and partially in network traffic. The article identifies artefacts that should be taken into account during inspection and search. Atomic Swaps of XMR are modelled to determine the trace pattern and identify artefacts of increased attention during forensic procedures. The fact that an atomic swap was carried out to obfuscate traces may be evidenced by the presence of specific software files on the disc used for this purpose.
 The algorithm for XMR withdrawal using multisig addresses has been proposed, from which funds can be withdrawn only when digital signatures of several persons are superimposed. The work of this algorithm in the test network Stagenet is modelled. It has been concluded that law enforcement agencies should focus on classical investigative measures to identify Monero users of interest. At the same time, there are effective mechanisms for documenting traces of work with the Monero payment system and proven methods for extracting passphrases to crypto-wallets and other sensitive information on the movement of funds in the Monero system from computer equipment.