- What CDCI Stands For and What It Is
- Who Issues It and How the Exam Works
- The Nine Preparation Areas
- Professional Eligibility
- Fees and Package Options
- The Optional 50-Hour Course
- Who Uses This Credential
- Keeping the Certification Active
- Sequencing Your Preparation
- What Is Not Publicly Verified
- Frequently Asked Questions
- CDCI means Certified Digital Currency Investigator, a credential issued by McAfee Institute for crypto-focused investigators.
- The exam-only route costs USD 450, runs three hours, is remotely proctored, and requires at least 70% to pass.
- Nine published learning objectives define preparation scope, but no official weighted exam blueprint has been verified.
- Eligibility rests on a degree-plus-experience formula, and the exam-only route does not require buying the course.
What CDCI Stands For and What It Is
CDCI stands for Certified Digital Currency Investigator. It is a professional certification for people who investigate crime involving cryptocurrency and other digital currencies: tracing funds across blockchains, recovering wallet-related evidence, recognizing laundering patterns, and documenting findings so they can support a prosecution or a compliance action. If you have seen other credentials that share the same four letters, set them aside. This article is about the investigator certification only. For shorter explainers on the same topic, see What Does CDCI Stand For? and CDCI Meaning.
The credential sits at the intersection of three disciplines that rarely appear together in a single exam: blockchain technology, criminal and financial investigation, and anti-money laundering practice. A candidate is expected to understand how a transaction is created and confirmed, how a criminal might try to hide it, and how an investigator turns a public ledger entry into documentation that survives scrutiny.
Who Issues It and How the Exam Works
The certification is offered by McAfee Institute. The board examination is described on the current exam page as assessing the competencies, standards, and applied knowledge covered throughout the program. Delivery is online and sponsor-administered, with remote proctoring. The public wording mentions ProctorU alongside AI-proctoring language, so confirm the actual workflow when you book rather than assuming a specific vendor experience.
Exam format at a glance
| Item | What is published |
|---|---|
| Time limit | 3 hours |
| Delivery | Online, remotely proctored, one sitting |
| Book status | Closed book |
| Question styles | Multiple-choice, true/false, and scenario-based |
| Passing threshold | At least 70% |
| Attempts | One attempt per exam license, usable for one year |
| Exact question count | Not publicly verified for CDCI |
| Calculator and adaptive rules | Not disclosed |
On question count, be careful. An institute-wide page references approximately 200 questions, but that figure is not an exact CDCI count, and the split between scored and unscored items is undisclosed. Plan for a long, sustained sitting, but do not build your pacing around a number the issuer has not confirmed for this credential. For a full discussion of what the score threshold means in practice, read CDCI Passing Score 2026.
Proctoring conditions
Remote proctoring brings practical requirements. You need valid ID, a working webcam, and a microphone. The published conditions also restrict extra monitors, VPNs, proxies, and virtual machines. That last group matters for this particular audience: investigators and analysts often work on layered, security-conscious setups, and a habitual VPN or a virtual machine on your daily-driver laptop could cause a problem on exam day. Test your environment on a clean, simple configuration well before your window opens, and see CDCI Exam Dates 2026 for scheduling considerations.
The Nine Preparation Areas
McAfee Institute publishes nine learning objectives for the program. These are reproduced here as unweighted preparation categories. They are not an official weighted or exhaustive exam blueprint, and no one can truthfully tell you which of them carries the most weight. What they do provide is a reliable map of the knowledge the program is built around. For a deeper walk through each one, see CDCI Exam Domains 2026: Complete Guide to All 9 Content Areas.
Domain 1: Blockchain & Cryptocurrency Fundamentals
The foundation: how blockchain networks work, how transactions are created and confirmed, and how major cryptocurrencies and digital assets function in real investigations.
- Transaction lifecycle from creation to confirmation
- How different assets behave on their networks
- Why ledger structure shapes what an investigator can see
Domain 2: Cryptocurrency Transaction Tracing
Practical expertise in following funds across wallets, exchanges, and decentralized networks to map the money trail and identify points of attribution.
- Following value hop by hop
- Recognizing where on-chain activity touches a regulated exchange
- Distinguishing attribution points from mere correlation
Domain 3: Obfuscation & Evasion Tactics
How criminals hide activity through mixers, tumblers, chain hopping, bridges, and layering, and how investigators can still recover the narrative behind the transactions.
- Mixers and tumblers
- Chain hopping and cross-chain bridges
- Layering techniques and how to reconstruct the story
Domain 4: Wallets, Keys, and Digital Evidence Recovery
Custodial versus non-custodial wallets, hardware and software wallets, seed phrases, and encryption concepts, plus the forensic approach to identifying, preserving, and analyzing wallet-related evidence.
- Custody models and what they mean for legal process
- Seed phrases and key material as evidence
- Preservation before analysis
Domain 5: Smart Contracts, Tokens, and DeFi Investigations
How tokens and smart contracts operate, how DeFi platforms are used legitimately and abused illegally, and how to identify fraud patterns, rug pulls, and exploit-driven transactions.
- Token and contract mechanics
- Rug pull and exploit patterns
- Separating legitimate DeFi use from abuse
Domain 6: Dark Web & Illicit Cryptocurrency Ecosystems
How crypto is used in dark web marketplaces and anonymized environments, and the investigative techniques that connect transactions to criminal activity and operational infrastructure.
- Marketplace payment flows
- Linking transactions to infrastructure
- Working within anonymized environments
Domain 7: AML Indicators & Financial Crime Patterns
Recognizing crypto-specific money laundering typologies, red flags, and behavioral patterns tied to fraud, theft, extortion, and illicit finance.
- Typologies specific to digital assets
- Behavioral red flags
- Pattern recognition across crime types
Domain 8: Seizure, Securing Assets, and Case-Ready Reporting
How to protect and secure digital assets when lawful authority exists, maintain chain of custody, and produce clear, prosecutable documentation that holds up under scrutiny.
- Lawful authority as a precondition
- Chain of custody for intangible assets
- Report writing for prosecutors and courts
Domain 9: Applying Anti-Money Laundering (AML) Techniques to Digital Currencies
AML strategies as they apply to cryptocurrency and digital currency, including compliance measures, red flags for laundering schemes, and how to apply AML protocols in cryptocurrency investigations.
- Compliance measures in a digital-asset context
- Red flags for laundering schemes
- Applying AML protocols inside an investigation
Note that Domains 7 and 9 both involve AML. Domain 7 leans toward recognizing indicators and patterns of financial crime; Domain 9 leans toward applying AML strategy and compliance measures. Expect to see the same underlying concepts viewed from an investigator's angle in one and a compliance angle in the other.
The three performance objectives
Alongside the nine learning objectives, the program publishes three performance objectives that describe what a certified person should be able to do:
- Describe digital currency ecosystems, transaction structures, and investigative considerations.
- Identify and analyze illicit digital currency activity, including laundering typologies.
- Produce investigative documentation addressing digital currency misuse and financial crime indicators.
The third objective is a useful signal about the whole credential. It is not purely a theory exam about blockchains; it expects you to turn analysis into documentation. Scenario-based questions are a natural fit for that expectation.
Professional Eligibility
The certification is not open to everyone on the strength of a purchase. Professional eligibility is built around a combination of education and experience, along with conduct screening:
- A bachelor's degree plus 4 years of relevant experience, or
- An associate degree plus 6 years of relevant experience, or
- A high-school diploma or equivalent plus 7 years of relevant experience.
Relevant experience involves investigations, intelligence, law enforcement, criminal justice, military service, or comparable responsibilities. No verified reference count is published. If you are weighing whether you qualify, the dedicated breakdown in CDCI Requirements 2026: Eligibility, Prerequisites & How to Qualify goes through the combinations in more detail.
Fees and Package Options
Pricing is straightforward on the exam side and more layered once training enters the picture. Here is what the published terms support:
| Option | Published price | Notes |
|---|---|---|
| Exam only | USD 450 | Three-hour time limit, online proctored, one attempt, one-year exam license |
| Another attempt | USD 450 | A new exam license is needed for each attempt |
| Training-and-exam package | USD 2,997 | Includes the optional course |
| Self-pay scholarship rendering | USD 1,199 | Conditional offer, not the universal exam fee |
There is no published member versus non-member split on the exam fee. Treat the USD 1,199 figure as a conditional scholarship-style rendering that depends on circumstances, not as a price anyone can count on. Because each exam license covers one attempt, a failed sitting means paying again, which is a good reason to use the one-year license window deliberately instead of booking at the earliest opportunity. A full cost discussion lives in CDCI Certification Cost 2026: Complete Pricing Breakdown.
The Optional 50-Hour Course
Buying training is not mandatory for the exam-only route. If you qualify professionally and feel confident in the material, you can sit the exam without the course. For many candidates, though, especially those who come from traditional investigation or compliance backgrounds without deep blockchain exposure, the course is the structured path through the content.
The course is advertised as 50 hours across 19 modules. The public curriculum narrative describes a progression: it starts with cryptocurrency, blockchain, encryption, anonymization networks, wallets, and transactions, then moves into investigative methodologies, wallet and address analysis, financial trails, criminal indicators, asset seizure, case-file preparation, money laundering, legal considerations, and digital-currency investigation platforms.
Key Takeaway
The 19 modules are not 19 exam domains, and 50 training hours are not exam time or topic weights. Do not read the module count as a blueprint. Lifetime training access, where offered, also should not be confused with lifetime certification, because the credential itself renews on a schedule. For more on the learning side, see CDCI Training.
Who Uses This Credential
The eligibility language tells you who the credential is aimed at: people working in investigations, intelligence, law enforcement, criminal justice, military roles, or comparable settings. In practice, that points toward agencies and organizations that deal with fraud, theft, extortion, ransomware payments, and illicit finance, and toward compliance and financial-crime teams that need staff who can follow digital-asset flows. The case-ready reporting emphasis suggests the credential is also relevant wherever investigators hand findings to prosecutors or regulators.
Be cautious about specific hiring claims. No salary figures or placement statistics are published in the sources used for this article, so none are asserted here. If you are evaluating return on investment, work through CDCI Jobs, CDCI Salary Guide 2026, and Is the CDCI Certification Worth It? with your own market and role in mind.
Keeping the Certification Active
Certification is not permanent. It renews every two years for USD 125 plus proof of continuing professional education (CPE). The exact number of required CPE or ethics credits is not publicly verified, so check the current renewal terms with the issuer instead of relying on a figure from a third party. Because the technology and criminal tradecraft in this field change quickly, a renewal cycle that requires ongoing learning is consistent with the nature of the work.
Sequencing Your Preparation
You do not need an elaborate method; you need an order that respects how the nine areas build on each other. Since no domain weighting is published, spread effort sensibly across all nine, and lean harder on whichever areas are newest to you. A sample ordering that follows the logic of the content:
Foundations first
- Domain 1: transaction creation, confirmation, and how major assets function
- Domain 4: wallet types, keys, seed phrases, encryption concepts
Following the money
- Domain 2: tracing across wallets, exchanges, and decentralized networks
- Domain 3: mixers, tumblers, chain hopping, bridges, layering
Newer attack surfaces
- Domain 5: smart contracts, tokens, DeFi, rug pulls, exploits
- Domain 6: dark web marketplaces and anonymized environments
Crime patterns and compliance
- Domain 7: laundering typologies and behavioral red flags
- Domain 9: AML techniques and compliance measures applied to digital currencies
Legal process and documentation, then full review
- Domain 8: lawful seizure, chain of custody, case-ready reporting
- Scenario practice across all nine areas under timed conditions
The reasoning: wallets and fundamentals come first because every tracing and evasion question assumes you understand them. Tracing and obfuscation pair naturally, since each is the other's counterpart. DeFi and dark web topics come once the basics are solid. AML and seizure/reporting finish the sequence because they depend on everything earlier, and the reporting domain ties directly to the third performance objective. Adjust the pace to your background; a seasoned financial investigator may compress the AML weeks and extend the technical ones. The pacing and resource advice in the CDCI Study Guide 2026 and the quick-reference CDCI Cheat Sheet can help refine the plan, and you can drill scenario-style items on the CDCI practice test site.
Because the exam includes scenario-based questions, practice reasoning through a situation, not just recalling definitions. For each topic, ask what evidence you would look for, what legal authority you would need, and how you would document the result. The practice questions on the main practice site are editorially allocated across the nine areas rather than weighted to an official blueprint, so treat them as coverage drills, not a prediction of exam proportions.
What Is Not Publicly Verified
An honest overview should say plainly where the public record runs out. The following items could not be confirmed from the issuer's public pages:
- The exact number of questions on the CDCI exam, and how many are scored versus unscored.
- Numerical topic weights or an official weighted blueprint.
- A dated or numbered exam version or a recent revision date.
- The candidate pass rate, which is not publicly disclosed. See CDCI Pass Rate 2026: What the Data Shows for how to think about this gap.
- The specific titles of the 19 course modules, since the public curriculum module list was empty.
- Whether a calculator is permitted or whether the exam adapts to your answers.
- The precise CPE and ethics credit requirements for renewal.
Anyone quoting precise figures for these items is guessing or borrowing from a different credential. If a decision depends on one of them, ask the issuer directly. For a realistic read on difficulty given these unknowns, see How Hard Is the CDCI Exam?. Related explainers include What Is CDCI Certification?, What Is A CDCI?, and CDCI Certification.
Frequently Asked Questions
In this context, CDCI stands for Certified Digital Currency Investigator, a certification from McAfee Institute focused on investigating crime involving cryptocurrency and other digital currencies.
The exam-only fee is USD 450, which covers one attempt and a one-year exam license. Another attempt costs USD 450. A training-and-exam package is listed at USD 2,997, and a separate USD 1,199 self-pay scholarship rendering is conditional rather than the standard exam fee.
The exam has a three-hour time limit, is closed book, and is remotely proctored in one sitting. The published final-exam threshold is at least 70%. The exact question count is not publicly verified.
No. Training is not mandatory for the exam-only route. The optional course is 50 hours across 19 modules, and it is a structured way to learn the material rather than a requirement.
It renews every two years for USD 125 plus proof of continuing professional education. The exact required CPE or ethics credits are not publicly verified, and lifetime training access does not mean lifetime certification.