- What You Are Actually Studying For
- Eligibility, Fees, and Exam-Day Logistics
- Planning Around an Unpublished Blueprint
- The Nine Preparation Areas, One by One
- Sequencing Your Weeks by Domain
- Handling Scenario-Based Questions
- Remote Proctoring: Getting Your Setup Right
- After the Pass: Renewal and Career Use
- Frequently Asked Questions
- The exam is 3 hours, closed book, remotely proctored, with a published passing threshold of at least 70%.
- The exam-only route costs USD 450; the optional 50-hour, 19-module training is not required to sit the exam.
- No official weighted blueprint exists publicly, so study all nine published learning objectives evenly.
- Eligibility requires degree-plus-experience combinations (4, 6 or 7 years) with conduct screening before you attempt.
What You Are Actually Studying For
The Certified Digital Currency Investigator (CDCI) credential is issued by the McAfee Institute, and it tests applied investigative competence rather than trading knowledge or blockchain theory for its own sake. The current exam page describes a board examination that assesses the competencies, standards and applied knowledge covered throughout the program. In practice, that means you are expected to think like an investigator: follow funds, preserve evidence, recognize laundering patterns and document findings so they survive scrutiny.
If you are still orienting yourself, start with the foundational explainers: What Is CDCI Certification? covers the credential itself, and What Does CDCI Stand For? clears up the acronym. This guide assumes you have decided to pursue the credential and want a plan to pass on the first attempt.
The published performance objectives frame what the exam is really after. Candidates should be able to:
- Describe digital currency ecosystems, transaction structures and investigative considerations.
- Identify and analyze illicit digital currency activity, including laundering typologies.
- Produce investigative documentation addressing digital currency misuse and financial crime indicators.
Notice the verbs: describe, identify, analyze, produce. This is a credential about doing investigative work, so your preparation should lean toward applying concepts to case scenarios instead of memorizing glossary terms.
Eligibility, Fees, and Exam-Day Logistics
Who Qualifies
The credential has a professional-experience gate. The published eligibility paths are:
| Education Level | Relevant Experience Required |
|---|---|
| Bachelor's degree | 4 years |
| Associate degree | 6 years |
| High-school diploma or equivalent | 7 years |
Qualifying experience involves investigations, intelligence, law enforcement, criminal justice, military service or comparable responsibilities, and conduct screening applies. Our CDCI requirements guide walks through how to document your background so there are no surprises when you apply.
What It Costs
The fee structure has a few moving parts, so read it carefully:
| Item | Published Amount |
|---|---|
| Exam only (one attempt, one-year license) | USD 450 |
| Another attempt | USD 450 |
| Training-and-exam package | USD 2,997 |
| Renewal every 2 years | USD 125 plus proof of CPE |
A separate USD 1,199 self-pay scholarship rendering also appears in the institute's materials, but it is conditional and should not be treated as the universal exam fee. No member versus non-member price split is published. For a fuller breakdown, see the CDCI certification cost guide.
Format and Timing
The exam runs three hours, is closed book, and is taken in one sitting under remote proctoring. The general published format mixes multiple-choice, true/false and scenario-based questions. The institute-wide page references approximately 200 questions, but that is not a verified CDCI-specific count, and the scored versus unscored split is undisclosed. Treat the number as unknown and plan your pacing around the three-hour limit instead. Calculator and adaptive-testing rules are also undisclosed.
Each exam license covers one attempt and is usable for one year, so you control when you sit within that window. See the CDCI exam dates guide for scheduling considerations.
Planning Around an Unpublished Blueprint
Here is the honest situation: there is no official weighted exam blueprint publicly available, no dated or numbered exam version, and no way to say which domain carries the most questions. The nine public learning objectives are the best scope document you have, and they should be read as unweighted preparation categories rather than an exhaustive or official blueprint. The 19 advertised course modules are likewise not nineteen exam domains.
That has a direct strategy implication. Without weights, you cannot safely skip a domain on the theory that it is lightly tested. The responsible approach is breadth first: reach a solid working level on all nine areas, then deepen the ones where scenario questions are likely to demand multi-step reasoning, such as tracing, obfuscation and evidence handling. The CDCI exam domains guide expands on each area in detail.
Key Takeaway
Do not trust any source that claims exact domain percentages for this exam. None are publicly verified. Allocate your study time roughly evenly at first, then adjust based on practice-question performance rather than guesswork.
The Nine Preparation Areas, One by One
Domain 1: Blockchain & Cryptocurrency Fundamentals
This is the base layer. You need to understand how blockchain networks work, how transactions are created and confirmed, and how major cryptocurrencies and digital assets function in real investigations.
- Transaction lifecycle: creation, broadcast, confirmation
- Differences between major assets and why they matter for tracing
- What the ledger does and does not reveal about identity
Domain 2: Cryptocurrency Transaction Tracing
Practical expertise in following funds across wallets, exchanges and decentralized networks. The goal is to map the money trail and identify points of attribution.
- Following value across addresses and hops
- Recognizing exchange touchpoints where identity records may exist
- Separating a documented finding from an inference
Domain 3: Obfuscation & Evasion Tactics
Criminals hide activity through mixers, tumblers, chain hopping, bridges and layering. You must know how each works and how investigators still recover the narrative behind the transactions.
- Mixer and tumbler mechanics and their typical residual patterns
- Cross-chain movement through bridges
- Layering logic: why many small hops are a signal in themselves
Domain 4: Wallets, Keys, and Digital Evidence Recovery
Know custodial versus non-custodial wallets, hardware and software wallets, seed phrases and encryption concepts, plus the forensic approach to identifying, preserving and analyzing wallet-related evidence.
- Who controls the keys in each wallet type, and what that means for seizure
- Seed phrase significance as a single point of control
- Preserving wallet artifacts without altering them
Domain 5: Smart Contracts, Tokens, and DeFi Investigations
Examine how tokens and smart contracts operate, how DeFi platforms are used legitimately and abused, and how to identify fraud patterns, rug pulls and exploit-driven transactions.
- Token versus native-coin behavior
- Rug pull indicators and exploit transaction signatures
- Distinguishing legitimate DeFi activity from abuse
Domain 6: Dark Web & Illicit Cryptocurrency Ecosystems
Explore how crypto is used in dark web marketplaces and anonymized environments, and learn techniques to connect transactions to criminal activity and operational infrastructure.
- Marketplace payment flows and escrow patterns
- Linking on-chain activity to operational infrastructure
- Limits of anonymization networks for investigators
Domain 7: AML Indicators & Financial Crime Patterns
Strengthen your ability to recognize crypto-specific laundering typologies, red flags and behavioral patterns tied to fraud, theft, extortion and illicit finance.
- Typology recognition from described behavior
- Red flags tied to fraud, theft and extortion proceeds
- Behavioral patterns versus single-transaction anomalies
Domain 8: Seizure, Securing Assets, and Case-Ready Reporting
Learn to protect and secure digital assets when lawful authority exists, maintain chain of custody, and produce clear, prosecutable documentation that holds up under scrutiny.
- Seizure only under lawful authority
- Chain of custody for digital assets and devices
- Report structure that a prosecutor or court can rely on
Domain 9: Applying Anti-Money Laundering (AML) Techniques to Digital Currencies
Gain expertise in AML strategies as they apply to digital currency, including compliance measures, red flags for laundering schemes and how to apply AML protocols in cryptocurrency investigations.
- Compliance measures as they apply to digital assets
- Applying AML protocols inside an investigation
- How this domain differs from Domain 7: recognition versus application
Sequencing Your Weeks by Domain
If you are studying on your own rather than through the course, sequence matters because later domains assume earlier ones. Fundamentals come before tracing, tracing before obfuscation, and evidence handling before reporting. Here is a nine-week arrangement that mirrors the logic of the curriculum, which progresses from cryptocurrency, blockchain, encryption, anonymization networks, wallets and transactions into investigative methodology, financial trails, seizure, case-file preparation, money laundering and legal considerations.
Foundations and Tracing
- Domain 1: transaction lifecycle and asset behavior
- Domain 2: practice following funds through example transaction chains
- Why first: every later domain assumes you can read a transaction
Evasion and Evidence
- Domain 3: mixers, tumblers, bridges, chain hopping, layering
- Domain 4: wallet types, keys, seed phrases, evidence preservation
- Why here: obfuscation is easier once tracing feels natural, and wallet knowledge underpins seizure
Contracts and Illicit Ecosystems
- Domain 5: tokens, smart contracts, DeFi abuse, rug pulls
- Domain 6: dark web marketplaces and anonymized environments
- Why here: these are the most specialized topics and benefit from a solid base
Financial Crime and AML
- Domain 7: typologies and red flags
- Domain 9: applying AML techniques and compliance measures
- Why paired: study the recognition and application framings back to back
Seizure, Reporting, and Full Review
- Domain 8: lawful seizure, chain of custody, case-ready documentation
- Timed mixed-domain practice under three-hour conditions
- Why last: reporting synthesizes everything you have learned
If you already work in financial crime or fraud, compress the AML weeks and spend the time on Domains 3, 5 and 6, which are the most crypto-native. If you come from a pure blockchain background, do the reverse and invest heavily in Domains 4 and 8, where legal authority and evidence handling dominate. Our CDCI cheat sheet is useful as a final-week consolidation tool.
Handling Scenario-Based Questions
Because the format includes scenario-based items alongside multiple-choice and true/false, expect questions that describe an investigative situation and ask for the best next step, the most likely typology or the correct handling of evidence. A few CDCI-specific habits help:
- Anchor on lawful authority. Whenever a scenario involves seizing or securing assets, the correct answer almost always respects legal process and chain of custody. The curriculum language is explicit that securing assets happens when lawful authority exists.
- Distinguish finding from conclusion. Tracing supports attributed findings only within documented evidentiary and legal limits. Course outcomes do not guarantee identifying every wallet owner or recovering stolen assets, so be skeptical of answer choices that claim certainty the evidence cannot support.
- Read for the typology. In AML and obfuscation scenarios, the behavior described, such as rapid movement through many addresses or cross-chain hops, usually points to the right laundering stage.
- Prefer documentation-forward answers. One of the three performance objectives is producing investigative documentation. When two options seem plausible, the one that preserves and records evidence cleanly tends to align better with the credential's emphasis.
How demanding is all this? That depends heavily on your background; our CDCI difficulty guide discusses what makes the exam challenging, and our pass rate article explains why no candidate pass rate can be cited, since none is publicly disclosed. To calibrate your readiness with realistic scenario items, use the CDCI practice tests and review every explanation, not just your score.
Remote Proctoring: Getting Your Setup Right
The exam is delivered online under proctoring. The institute's FAQ names ProctorU alongside AI-proctoring wording, so confirm the actual workflow when you schedule rather than assuming one process. What is consistently stated:
- A valid ID, webcam and microphone are required.
- Restrictions apply to extra monitors, VPNs, proxies and virtual machines.
- The exam is closed book and must be completed in one sitting.
These restrictions catch investigators off guard precisely because many of us run VPNs and virtual machines as a matter of professional hygiene. Disable and close them, use a single monitor, and test your hardware before the day. A technical problem you could have prevented is the cheapest way to lose an attempt, and each attempt carries a USD 450 price tag.
After the Pass: Renewal and Career Use
Certification renews every two years for USD 125 plus proof of continuing professional education. The exact number of required CPE or ethics credits is not publicly verified, so confirm current requirements directly with the institute. One point worth emphasizing: lifetime access to training materials is not the same as lifetime certification. The credential itself must be renewed.
As for where the credential is used, the experience prerequisites tell you the target audience: professionals in investigations, intelligence, law enforcement, criminal justice, military and comparable roles, which also points to the kinds of employers and agencies that value it. For a realistic look at the market, see our overview of CDCI jobs and the CDCI salary guide; we avoid quoting specific earnings figures here because none are verified for this credential.
Frequently Asked Questions
No. The exam-only route at USD 450 does not require purchasing the optional 50-hour, 19-module course. The course is a structured way to cover the nine learning objectives, but experienced candidates may self-study.
The published final-exam threshold is at least 70%. The exact question count and the split between scored and unscored items are not publicly verified, so a precise number of questions you must answer correctly cannot be stated.
That cannot be stated. No official weighted blueprint is publicly available, and the nine learning objectives are best treated as unweighted preparation categories. Study all nine rather than betting on assumed weights.
Each exam license covers one attempt and is usable for one year. Another attempt costs USD 450. That is why building a full-length, timed practice habit before your first sitting is worthwhile.
No. The remote proctoring rules restrict extra monitors, VPNs, proxies and virtual machines, and you need ID, a webcam and a microphone. Confirm the exact workflow when you schedule, since ProctorU and AI-proctoring wording both appear in the institute's FAQ.
Pass on the first attempt by treating the nine published learning objectives as your complete syllabus, practicing scenario reasoning instead of memorizing definitions, and arriving at exam day with a verified, restriction-free setup. For a broader look at the credential, our CDCI certification overview is a good companion, and the practice test platform lets you rehearse under timed conditions before you commit to an attempt.