- Identity Check: Which CDCI This Sheet Covers
- The Exam at a Glance
- Money and Eligibility Mechanics
- The Nine Learning Objectives, Condensed
- Test-Day Rules and Remote Proctoring
- Tracing vs. Evasion: The Core Tension
- Evidence, Seizure and Reporting Facts
- AML Red Flags to Memorize
- Sequencing Your Review Around the Nine Areas
- After You Pass: Renewal and Career Context
- What Is Still Unverified
- FAQ
- The CDCI here is McAfee Institute's Certified Digital Currency Investigator: a 3-hour, closed-book, remotely proctored exam with a 70% threshold.
- Exam-only costs USD 450 and includes one attempt on a one-year exam license; the 50-hour course is optional.
- The exact question count is not publicly verified, and no official weighted blueprint exists, so study all nine areas evenly.
- Eligibility pairs education with experience: 4, 6 or 7 years of relevant work depending on your degree level.
Identity Check: Which CDCI This Sheet Covers
Several credentials share the acronym "CDCI," so a quick clarification saves you from studying the wrong material. This cheat sheet covers the Certified Digital Currency Investigator credential offered through the McAfee Institute. It is an investigator-focused certification about tracing, documenting and reporting on cryptocurrency and digital-currency activity. If you want the broader background first, start with What Is CDCI? or What Does CDCI Stand For?, then return here for the one-page review.
Everything below is drawn from the publicly retrieved CDCI product and exam pages. Where a detail is not publicly confirmed, this sheet says so rather than guessing. For a candidate, knowing what you do not know about the exam is itself a useful planning input.
The Exam at a Glance
| Item | What Is Verified |
|---|---|
| Issuing body | McAfee Institute |
| Delivery | Online, sponsor-administered, remotely proctored (confirm the exact proctoring workflow at registration) |
| Time limit | 3 hours, one sitting |
| Question count | Not publicly verified for the CDCI specifically; the institute-wide page cites approximately 200, which is not an exact CDCI figure |
| Scored vs. unscored | Undisclosed |
| Question styles | Multiple-choice, true/false and scenario-based (general published format) |
| Passing threshold | At least 70% |
| Book policy | Closed book |
| Attempts | One attempt per exam license, usable for one year |
| Candidate pass rate | Not publicly disclosed |
The official exam page describes the assessment as covering competencies, standards and applied knowledge from across the program. The phrase "applied knowledge" matters: expect scenarios where you must decide what an investigator should do with a given transaction pattern, wallet artifact or case file, not just recall definitions. For deeper detail on thresholds, see CDCI Passing Score 2026, and for difficulty context see How Hard Is the CDCI Exam?
Money and Eligibility Mechanics
Fees and licensing
- Exam-only: USD 450, covering one attempt on a one-year exam license.
- Another attempt: USD 450.
- Training-and-exam package: USD 2,997.
- Scholarship rendering: a separate USD 1,199 self-pay figure exists, but it is conditional and should not be treated as the universal exam fee.
- Member/non-member pricing: no split is published.
- Renewal: USD 125 every 2 years, plus proof of CPE.
The training course is optional for the exam-only route. If you already have investigative or financial-crime experience, you can weigh whether the 50-hour, 19-module course is worth the price difference. The full picture is in CDCI Certification Cost 2026.
Professional eligibility
| Education Level | Relevant Experience Needed |
|---|---|
| Bachelor's degree | 4 years |
| Associate degree | 6 years |
| High-school diploma or equivalent | 7 years |
Qualifying experience involves investigations, intelligence, law enforcement, criminal justice, military service or comparable responsibilities, and conduct screening applies. Review CDCI Requirements 2026 before paying, so you are certain your background fits.
The Nine Learning Objectives, Condensed
The nine public learning objectives are the best available map of scope. They are course-preparation categories, not an official weighted or exhaustive exam blueprint, and the advertised 19 modules are not 19 exam domains. Treat the list as unweighted: no domain can be labeled the heaviest. For a fuller walkthrough, see CDCI Exam Domains 2026: Complete Guide to All 9 Content Areas.
Domain 1: Blockchain & Cryptocurrency Fundamentals
The foundation: how blockchain networks work, how transactions are created and confirmed, and how major cryptocurrencies and digital assets function in real investigations.
- Transaction creation versus confirmation
- How major assets behave differently on-chain
Domain 2: Cryptocurrency Transaction Tracing
Following funds across wallets, exchanges and decentralized networks to map the money trail and identify points of attribution.
- Wallet-to-wallet and exchange hand-offs
- Where attribution realistically becomes possible
Domain 3: Obfuscation & Evasion Tactics
Mixers, tumblers, chain hopping, bridges and layering, plus how investigators can still recover the narrative behind the transactions.
Domain 4: Wallets, Keys, and Digital Evidence Recovery
Custodial vs. non-custodial wallets, hardware and software wallets, seed phrases and encryption concepts, with a forensic approach to identifying, preserving and analyzing wallet-related evidence.
Domain 5: Smart Contracts, Tokens, and DeFi Investigations
How tokens and smart contracts operate, legitimate versus abusive DeFi use, and fraud patterns including rug pulls and exploit-driven transactions.
Domain 6: Dark Web & Illicit Cryptocurrency Ecosystems
Crypto use in dark web marketplaces and anonymized environments, and techniques that connect transactions to criminal activity and operational infrastructure.
Domain 7: AML Indicators & Financial Crime Patterns
Crypto-specific laundering typologies, red flags and behavioral patterns tied to fraud, theft, extortion and illicit finance.
Domain 8: Seizure, Securing Assets, and Case-Ready Reporting
Protecting and securing digital assets when lawful authority exists, maintaining chain of custody, and producing clear, prosecutable documentation that holds up under scrutiny.
Domain 9: Applying Anti-Money Laundering (AML) Techniques to Digital Currencies
AML strategies as they apply to cryptocurrency: compliance measures, money-laundering red flags, and applying AML protocols in cryptocurrency investigations.
Test-Day Rules and Remote Proctoring
The exam is taken remotely in a single sitting. The published requirements include a valid ID, a webcam and a microphone, along with restrictions on extra monitors, VPNs, proxies and virtual machines. Because ProctorU is named in the FAQ alongside AI-proctoring wording, confirm the exact workflow when you register rather than assuming one model.
- Run your equipment check well before exam day, not minutes before.
- Disconnect any VPN or proxy and close virtual-machine software, since these are restricted.
- Use a single monitor.
- Whether a calculator is allowed, and whether the exam is adaptive, is undisclosed; do not plan around either.
Because you get one attempt per exam license, a technical problem you could have prevented is an expensive mistake. Scheduling specifics are covered in CDCI Exam Dates 2026.
Tracing vs. Evasion: The Core Tension
Domains 2 and 3 form the conceptual heart of the credential, and scenario questions often sit at their intersection. The tracing domain asks how an investigator follows value; the evasion domain asks how a subject tries to break that trail. Learn them as a pair.
| Evasion Technique | What It Does to the Trail | Investigator's Angle |
|---|---|---|
| Mixers / tumblers | Pools and redistributes funds to weaken the direct link between source and destination | Recover the narrative from timing, amounts and surrounding activity |
| Chain hopping | Moves value between different blockchains | Follow the conversion points across networks |
| Bridges | Transfers assets across chains via cross-chain mechanisms | Treat the bridge as a documented hand-off in the trail |
| Layering | Adds intermediate steps to obscure origin | Map the full path and identify attribution points along it |
Evidence, Seizure and Reporting Facts
Domains 4 and 8 translate technical skill into admissible, defensible work. Candidates who think only about blockchain mechanics tend to underprepare here.
Wallet and key concepts
- Know the difference between custodial and non-custodial wallets and what each means for who controls the keys.
- Understand hardware versus software wallets and why seed phrases are both a recovery mechanism and a critical piece of evidence.
- Be able to describe, at a conceptual level, how encryption affects access to wallet data.
Seizure and documentation
- Securing assets presumes lawful authority; the curriculum frames seizure as something done when that authority exists.
- Chain of custody applies to digital evidence just as it does to physical evidence.
- Reports should be clear and prosecutable, meaning another professional can follow your steps and reach the same understanding.
The published performance objectives reinforce this: describe digital currency ecosystems and investigative considerations, identify and analyze illicit activity including laundering typologies, and produce investigative documentation addressing digital currency misuse and financial crime indicators.
AML Red Flags to Memorize
Two of the nine areas, Domain 7 and Domain 9, center on anti-money laundering, so the topic deserves outsized attention even though no official weights are published. Domain 7 emphasizes recognizing crypto-specific laundering typologies and behavioral patterns tied to fraud, theft, extortion and illicit finance. Domain 9 emphasizes applying AML strategies, including compliance measures and protocols, within cryptocurrency investigations.
How to Separate Domains 7 and 9
Think of Domain 7 as recognition and Domain 9 as application.
- Recognition: spotting the typology, the red flag, the behavioral pattern.
- Application: deciding which compliance measure or AML protocol fits the investigation in front of you.
Related DeFi and token fraud patterns from Domain 5, including rug pulls and exploit-driven transactions, frequently overlap with these AML themes, as do dark web flows from Domain 6. Study them together so a single scenario does not catch you switching mental modes.
Sequencing Your Review Around the Nine Areas
Because no official weighting exists, a sensible plan covers all nine areas and orders them by dependency: you cannot trace what you do not understand. One CDCI-specific sequence works as follows. For a fuller plan, see the CDCI Study Guide 2026.
Foundations and Tracing
- Domain 1: transaction creation, confirmation, major assets
- Domain 2: following funds across wallets, exchanges and decentralized networks
Adversary Methods
- Domain 3: mixers, tumblers, chain hopping, bridges, layering
- Domain 6: dark web marketplaces and anonymized environments
Technical and Contract-Level Evidence
- Domain 4: wallets, keys, seed phrases, evidence preservation
- Domain 5: tokens, smart contracts, DeFi abuse, rug pulls
Financial Crime and Case Work
- Domains 7 and 9: laundering typologies and AML application
- Domain 8: seizure, chain of custody, case-ready reporting
- Full timed practice under closed-book conditions
Scenario practice is the best use of your final week, since the exam is described as applied. The CDCI practice tests are a convenient way to rehearse under timed, closed-book conditions.
After You Pass: Renewal and Career Context
The certification renews every 2 years for USD 125 plus proof of CPE. The exact number of required CPE or ethics credits is not publicly verified, so check current renewal terms directly with the institute. One point is easy to miss: lifetime access to training materials is not the same as lifetime certification. Your credential stays active only if you renew.
The credential is aimed at people whose work involves investigations, intelligence, law enforcement, criminal justice, military duties or comparable responsibilities, which mirrors the eligibility pathway. That makes it relevant to roles that touch cryptocurrency-linked fraud, theft, extortion and laundering. For role-level detail, see CDCI Jobs; for earnings discussion, CDCI Salary Guide 2026; and for the value question, Is the CDCI Certification Worth It?
What Is Still Unverified
A trustworthy cheat sheet states its gaps. As of the public sources reviewed, the following remain unconfirmed:
- The exact CDCI question count and the scored/unscored split.
- Any numerical topic weights or an official weighted blueprint.
- A dated or numbered exam version or a new revision date.
- The titles of the 19 advertised modules.
- The exact CPE and ethics credit requirements for renewal.
- Candidate pass rates; see CDCI Pass Rate 2026 for what can and cannot be said.
Key Takeaway
Prepare for breadth, not for a rumored weighting. With nine unweighted areas, a closed-book three-hour window and one attempt per license, the safest strategy is balanced coverage of every domain plus timed scenario practice. Confirm logistics and renewal terms directly with McAfee Institute before you pay.
FAQ
The exam runs three hours in a single sitting, and the published final-exam threshold is at least 70%. The exact question count and scored/unscored split are not publicly verified for the CDCI.
No. The exam-only route does not require purchasing training. The optional course is 50 hours across 19 modules, and the training-and-exam package is listed at USD 2,997 versus USD 450 for the exam alone.
None can be named. The nine learning objectives are unweighted preparation categories, and no official weighted exam blueprint has been verified, so study all nine areas rather than betting on one.
A valid ID, a webcam and a microphone are required. Extra monitors, VPNs, proxies and virtual machines are restricted. The exam is closed book and remotely proctored, so confirm the proctoring workflow when you register.
Certification renews every 2 years for USD 125 plus proof of CPE. The exact CPE or ethics credit requirement is not publicly verified, and lifetime training access does not equal lifetime certification.