INTELLIGENCE ON CHAIN (IOC)

Level 2: Advanced Blockchain & OSINT Investigation Course

A professional cryptocurrency investigation course covering the full case lifecycle - from objectives, intake and evidence preservation through EVM and Bitcoin tracing, bridges, obfuscation, temporal analysis, clustering and OSINT attribution.

Level

Intermediate · Professional

Format

Live, instructor-led online training

Duration

8 hours · Two 4-hour sessions

Entry Requirements for the Beginner Blockchain Investigation

Level 1 completion or equivalent foundational knowledge is recommended.

Level 2 is designed for learners who already understand the basic mechanics of cryptocurrency transactions and want to develop professional investigation methodology.


Participants should be comfortable with basic blockchain terminology, wallet addresses, transaction hashes and public block explorers. The course is suitable for investigators, analysts, compliance professionals, cyber teams and experienced self-taught researchers who want a more structured approach to casework.

Recommended Before You Attend

- IOC Level 1 completion, or equivalent basic crypto / OSINT knowledge

- Confidence navigating public block explorers

- Basic understanding of wallets, transactions and common crypto services

Advanced Cryptocurrency Investigation Curriculum

Investigation objectives & scope design

Define what the investigation must establish, identify realistic questions and avoid unnecessary or unsupported analysis.

Investigation intake & case triage

Assess available evidence, urgency, relevant networks, likely complexity and the best starting points for a case.

Evidence collection & preservation

Capture blockchain evidence, transaction data and supporting material in a way that supports later review and reporting.

EVM tracing & research

Investigate EVM networks, wallet activity, token movement, contracts and transaction execution.

Bitcoin tracing

Follow UTXO-based transaction flows and understand the investigative differences between Bitcoin and account-based networks.

Bridges and cross-chain movement

Investigate non-explorer bridges and other pathways used to move value between blockchain networks.

Obfuscation techniques

Understand tactics used to complicate tracing, including layering, swaps, intermediary wallets and other fund-movement strategies.

Probabilistic auto-exchange analysis

Assess likely cross-service or automated exchange movement while distinguishing probabilistic indicators from confirmed evidence.

Temporal analysis

Use time and transaction timing as an investigative signal while understanding its evidential limitations.

Clustering, pattern recognition & OSINT pivots

Identify behavioural patterns and potential wallet relationships, then develop external OSINT pivots for attribution research.

Assessment & Pass Criteria

Certification requires both knowledge and practical investigative capability.

To earn the IOC Level 2 Certificate in Blockchain & OSINT Investigations, participants must successfully pass both assessment components: the knowledge examination and the practical cryptocurrency investigation scenario.


Level 2 is deliberately assessed in two different ways. The examination tests your understanding of the methods and concepts taught during the course, while the practical scenario tests whether you can apply those methods to a realistic cryptocurrency investigation.

  • Knowledge Examination: achieve a score of 85% or higher.
  • Practical Investigation Scenario: complete the investigation scenario provided and answer all required questions to a suitable standard.
  • Both components are mandatory: passing the examination alone does not qualify a participant for certification.
  • Successful participants receive the IOC Level 2 Certificate in Blockchain & OSINT Investigations.

View Upcoming Level 2 Dates

Take the next step to becoming an advanced investigator

View Course Dates