CDCI logo
Focused certification exam prep
Start practice

What Is CDCI?

TL;DR
  • CDCI means Certified Digital Currency Investigator, a credential issued by McAfee Institute for crypto-focused investigators.
  • The exam-only route costs USD 450, runs three hours, is remotely proctored, and requires at least 70% to pass.
  • Nine published learning objectives define preparation scope, but no official weighted exam blueprint has been verified.
  • Eligibility rests on a degree-plus-experience formula, and the exam-only route does not require buying the course.

What CDCI Stands For and What It Is

CDCI stands for Certified Digital Currency Investigator. It is a professional certification for people who investigate crime involving cryptocurrency and other digital currencies: tracing funds across blockchains, recovering wallet-related evidence, recognizing laundering patterns, and documenting findings so they can support a prosecution or a compliance action. If you have seen other credentials that share the same four letters, set them aside. This article is about the investigator certification only. For shorter explainers on the same topic, see What Does CDCI Stand For? and CDCI Meaning.

The credential sits at the intersection of three disciplines that rarely appear together in a single exam: blockchain technology, criminal and financial investigation, and anti-money laundering practice. A candidate is expected to understand how a transaction is created and confirmed, how a criminal might try to hide it, and how an investigator turns a public ledger entry into documentation that survives scrutiny.

Scope reminder: Investigative tracing supports attributed findings only within documented evidentiary and legal limits. Completing the course or earning the certification does not guarantee that you can identify every wallet owner or recover stolen assets. That candor about limits is part of the professional mindset the program teaches.

Who Issues It and How the Exam Works

The certification is offered by McAfee Institute. The board examination is described on the current exam page as assessing the competencies, standards, and applied knowledge covered throughout the program. Delivery is online and sponsor-administered, with remote proctoring. The public wording mentions ProctorU alongside AI-proctoring language, so confirm the actual workflow when you book rather than assuming a specific vendor experience.

Exam format at a glance

ItemWhat is published
Time limit3 hours
DeliveryOnline, remotely proctored, one sitting
Book statusClosed book
Question stylesMultiple-choice, true/false, and scenario-based
Passing thresholdAt least 70%
AttemptsOne attempt per exam license, usable for one year
Exact question countNot publicly verified for CDCI
Calculator and adaptive rulesNot disclosed

On question count, be careful. An institute-wide page references approximately 200 questions, but that figure is not an exact CDCI count, and the split between scored and unscored items is undisclosed. Plan for a long, sustained sitting, but do not build your pacing around a number the issuer has not confirmed for this credential. For a full discussion of what the score threshold means in practice, read CDCI Passing Score 2026.

Proctoring conditions

Remote proctoring brings practical requirements. You need valid ID, a working webcam, and a microphone. The published conditions also restrict extra monitors, VPNs, proxies, and virtual machines. That last group matters for this particular audience: investigators and analysts often work on layered, security-conscious setups, and a habitual VPN or a virtual machine on your daily-driver laptop could cause a problem on exam day. Test your environment on a clean, simple configuration well before your window opens, and see CDCI Exam Dates 2026 for scheduling considerations.

The Nine Preparation Areas

McAfee Institute publishes nine learning objectives for the program. These are reproduced here as unweighted preparation categories. They are not an official weighted or exhaustive exam blueprint, and no one can truthfully tell you which of them carries the most weight. What they do provide is a reliable map of the knowledge the program is built around. For a deeper walk through each one, see CDCI Exam Domains 2026: Complete Guide to All 9 Content Areas.

Domain 1: Blockchain & Cryptocurrency Fundamentals

The foundation: how blockchain networks work, how transactions are created and confirmed, and how major cryptocurrencies and digital assets function in real investigations.

  • Transaction lifecycle from creation to confirmation
  • How different assets behave on their networks
  • Why ledger structure shapes what an investigator can see

Domain 2: Cryptocurrency Transaction Tracing

Practical expertise in following funds across wallets, exchanges, and decentralized networks to map the money trail and identify points of attribution.

  • Following value hop by hop
  • Recognizing where on-chain activity touches a regulated exchange
  • Distinguishing attribution points from mere correlation

Domain 3: Obfuscation & Evasion Tactics

How criminals hide activity through mixers, tumblers, chain hopping, bridges, and layering, and how investigators can still recover the narrative behind the transactions.

  • Mixers and tumblers
  • Chain hopping and cross-chain bridges
  • Layering techniques and how to reconstruct the story

Domain 4: Wallets, Keys, and Digital Evidence Recovery

Custodial versus non-custodial wallets, hardware and software wallets, seed phrases, and encryption concepts, plus the forensic approach to identifying, preserving, and analyzing wallet-related evidence.

  • Custody models and what they mean for legal process
  • Seed phrases and key material as evidence
  • Preservation before analysis

Domain 5: Smart Contracts, Tokens, and DeFi Investigations

How tokens and smart contracts operate, how DeFi platforms are used legitimately and abused illegally, and how to identify fraud patterns, rug pulls, and exploit-driven transactions.

  • Token and contract mechanics
  • Rug pull and exploit patterns
  • Separating legitimate DeFi use from abuse

Domain 6: Dark Web & Illicit Cryptocurrency Ecosystems

How crypto is used in dark web marketplaces and anonymized environments, and the investigative techniques that connect transactions to criminal activity and operational infrastructure.

  • Marketplace payment flows
  • Linking transactions to infrastructure
  • Working within anonymized environments

Domain 7: AML Indicators & Financial Crime Patterns

Recognizing crypto-specific money laundering typologies, red flags, and behavioral patterns tied to fraud, theft, extortion, and illicit finance.

  • Typologies specific to digital assets
  • Behavioral red flags
  • Pattern recognition across crime types

Domain 8: Seizure, Securing Assets, and Case-Ready Reporting

How to protect and secure digital assets when lawful authority exists, maintain chain of custody, and produce clear, prosecutable documentation that holds up under scrutiny.

  • Lawful authority as a precondition
  • Chain of custody for intangible assets
  • Report writing for prosecutors and courts

Domain 9: Applying Anti-Money Laundering (AML) Techniques to Digital Currencies

AML strategies as they apply to cryptocurrency and digital currency, including compliance measures, red flags for laundering schemes, and how to apply AML protocols in cryptocurrency investigations.

  • Compliance measures in a digital-asset context
  • Red flags for laundering schemes
  • Applying AML protocols inside an investigation

Note that Domains 7 and 9 both involve AML. Domain 7 leans toward recognizing indicators and patterns of financial crime; Domain 9 leans toward applying AML strategy and compliance measures. Expect to see the same underlying concepts viewed from an investigator's angle in one and a compliance angle in the other.

The three performance objectives

Alongside the nine learning objectives, the program publishes three performance objectives that describe what a certified person should be able to do:

  1. Describe digital currency ecosystems, transaction structures, and investigative considerations.
  2. Identify and analyze illicit digital currency activity, including laundering typologies.
  3. Produce investigative documentation addressing digital currency misuse and financial crime indicators.

The third objective is a useful signal about the whole credential. It is not purely a theory exam about blockchains; it expects you to turn analysis into documentation. Scenario-based questions are a natural fit for that expectation.

Professional Eligibility

The certification is not open to everyone on the strength of a purchase. Professional eligibility is built around a combination of education and experience, along with conduct screening:

  • A bachelor's degree plus 4 years of relevant experience, or
  • An associate degree plus 6 years of relevant experience, or
  • A high-school diploma or equivalent plus 7 years of relevant experience.

Relevant experience involves investigations, intelligence, law enforcement, criminal justice, military service, or comparable responsibilities. No verified reference count is published. If you are weighing whether you qualify, the dedicated breakdown in CDCI Requirements 2026: Eligibility, Prerequisites & How to Qualify goes through the combinations in more detail.

Why the experience requirement matters: The experience formula signals that the issuer expects candidates to arrive with investigative habits already formed, such as documenting carefully, respecting legal process, and thinking in terms of evidence. The exam then layers crypto-specific knowledge on top of that professional base.

Fees and Package Options

Pricing is straightforward on the exam side and more layered once training enters the picture. Here is what the published terms support:

OptionPublished priceNotes
Exam onlyUSD 450Three-hour time limit, online proctored, one attempt, one-year exam license
Another attemptUSD 450A new exam license is needed for each attempt
Training-and-exam packageUSD 2,997Includes the optional course
Self-pay scholarship renderingUSD 1,199Conditional offer, not the universal exam fee

There is no published member versus non-member split on the exam fee. Treat the USD 1,199 figure as a conditional scholarship-style rendering that depends on circumstances, not as a price anyone can count on. Because each exam license covers one attempt, a failed sitting means paying again, which is a good reason to use the one-year license window deliberately instead of booking at the earliest opportunity. A full cost discussion lives in CDCI Certification Cost 2026: Complete Pricing Breakdown.

The Optional 50-Hour Course

Buying training is not mandatory for the exam-only route. If you qualify professionally and feel confident in the material, you can sit the exam without the course. For many candidates, though, especially those who come from traditional investigation or compliance backgrounds without deep blockchain exposure, the course is the structured path through the content.

The course is advertised as 50 hours across 19 modules. The public curriculum narrative describes a progression: it starts with cryptocurrency, blockchain, encryption, anonymization networks, wallets, and transactions, then moves into investigative methodologies, wallet and address analysis, financial trails, criminal indicators, asset seizure, case-file preparation, money laundering, legal considerations, and digital-currency investigation platforms.

Key Takeaway

The 19 modules are not 19 exam domains, and 50 training hours are not exam time or topic weights. Do not read the module count as a blueprint. Lifetime training access, where offered, also should not be confused with lifetime certification, because the credential itself renews on a schedule. For more on the learning side, see CDCI Training.

Who Uses This Credential

The eligibility language tells you who the credential is aimed at: people working in investigations, intelligence, law enforcement, criminal justice, military roles, or comparable settings. In practice, that points toward agencies and organizations that deal with fraud, theft, extortion, ransomware payments, and illicit finance, and toward compliance and financial-crime teams that need staff who can follow digital-asset flows. The case-ready reporting emphasis suggests the credential is also relevant wherever investigators hand findings to prosecutors or regulators.

Be cautious about specific hiring claims. No salary figures or placement statistics are published in the sources used for this article, so none are asserted here. If you are evaluating return on investment, work through CDCI Jobs, CDCI Salary Guide 2026, and Is the CDCI Certification Worth It? with your own market and role in mind.

Keeping the Certification Active

Certification is not permanent. It renews every two years for USD 125 plus proof of continuing professional education (CPE). The exact number of required CPE or ethics credits is not publicly verified, so check the current renewal terms with the issuer instead of relying on a figure from a third party. Because the technology and criminal tradecraft in this field change quickly, a renewal cycle that requires ongoing learning is consistent with the nature of the work.

Sequencing Your Preparation

You do not need an elaborate method; you need an order that respects how the nine areas build on each other. Since no domain weighting is published, spread effort sensibly across all nine, and lean harder on whichever areas are newest to you. A sample ordering that follows the logic of the content:

Week 1

Foundations first

  • Domain 1: transaction creation, confirmation, and how major assets function
  • Domain 4: wallet types, keys, seed phrases, encryption concepts
Week 2

Following the money

  • Domain 2: tracing across wallets, exchanges, and decentralized networks
  • Domain 3: mixers, tumblers, chain hopping, bridges, layering
Week 3

Newer attack surfaces

  • Domain 5: smart contracts, tokens, DeFi, rug pulls, exploits
  • Domain 6: dark web marketplaces and anonymized environments
Week 4

Crime patterns and compliance

  • Domain 7: laundering typologies and behavioral red flags
  • Domain 9: AML techniques and compliance measures applied to digital currencies
Week 5

Legal process and documentation, then full review

  • Domain 8: lawful seizure, chain of custody, case-ready reporting
  • Scenario practice across all nine areas under timed conditions

The reasoning: wallets and fundamentals come first because every tracing and evasion question assumes you understand them. Tracing and obfuscation pair naturally, since each is the other's counterpart. DeFi and dark web topics come once the basics are solid. AML and seizure/reporting finish the sequence because they depend on everything earlier, and the reporting domain ties directly to the third performance objective. Adjust the pace to your background; a seasoned financial investigator may compress the AML weeks and extend the technical ones. The pacing and resource advice in the CDCI Study Guide 2026 and the quick-reference CDCI Cheat Sheet can help refine the plan, and you can drill scenario-style items on the CDCI practice test site.

Because the exam includes scenario-based questions, practice reasoning through a situation, not just recalling definitions. For each topic, ask what evidence you would look for, what legal authority you would need, and how you would document the result. The practice questions on the main practice site are editorially allocated across the nine areas rather than weighted to an official blueprint, so treat them as coverage drills, not a prediction of exam proportions.

What Is Not Publicly Verified

An honest overview should say plainly where the public record runs out. The following items could not be confirmed from the issuer's public pages:

  • The exact number of questions on the CDCI exam, and how many are scored versus unscored.
  • Numerical topic weights or an official weighted blueprint.
  • A dated or numbered exam version or a recent revision date.
  • The candidate pass rate, which is not publicly disclosed. See CDCI Pass Rate 2026: What the Data Shows for how to think about this gap.
  • The specific titles of the 19 course modules, since the public curriculum module list was empty.
  • Whether a calculator is permitted or whether the exam adapts to your answers.
  • The precise CPE and ethics credit requirements for renewal.

Anyone quoting precise figures for these items is guessing or borrowing from a different credential. If a decision depends on one of them, ask the issuer directly. For a realistic read on difficulty given these unknowns, see How Hard Is the CDCI Exam?. Related explainers include What Is CDCI Certification?, What Is A CDCI?, and CDCI Certification.

Frequently Asked Questions

What does CDCI stand for?

In this context, CDCI stands for Certified Digital Currency Investigator, a certification from McAfee Institute focused on investigating crime involving cryptocurrency and other digital currencies.

How much does the CDCI exam cost?

The exam-only fee is USD 450, which covers one attempt and a one-year exam license. Another attempt costs USD 450. A training-and-exam package is listed at USD 2,997, and a separate USD 1,199 self-pay scholarship rendering is conditional rather than the standard exam fee.

How long is the exam and what score do I need?

The exam has a three-hour time limit, is closed book, and is remotely proctored in one sitting. The published final-exam threshold is at least 70%. The exact question count is not publicly verified.

Do I have to take the training course?

No. Training is not mandatory for the exam-only route. The optional course is 50 hours across 19 modules, and it is a structured way to learn the material rather than a requirement.

How long does the certification last?

It renews every two years for USD 125 plus proof of continuing professional education. The exact required CPE or ethics credits are not publicly verified, and lifetime training access does not mean lifetime certification.

Ready to pass your CDCI exam?

Put this into practice with free CDCI questions across every exam domain.