- How to Read the 16 Content Areas
- Foundations: Domains 1-4
- Transactions, Mining and Wallets: Domains 5-7
- Smart Contracts and Investigation Methods: Domains 8-10
- The Money Trail and Criminal Activity: Domains 11-12
- Seizure, Case Files, Laundering and Law: Domains 13-16
- Exam Format, Fees and Eligibility
- Sequencing the Domains in Your Prep
- Where These Skills Get Used
- Frequently Asked Questions
- The 16 content areas map to course modules 02 through 17; orientation (01) and the final exam (18) are excluded.
- These headings are unweighted preparation areas, not an official weighted exam blueprint, so study all sixteen.
- The McAfee Institute exam runs 3 hours, closed book, online, with multiple-choice, true/false and scenario questions.
- You need at least 70% to pass; the standalone exam license costs $450 and includes one proctored attempt.
How to Read the 16 Content Areas
The Certified Cryptocurrency Forensic Investigator (CCFI) credential from the McAfee Institute is built around a practical question: can you trace, document and present cryptocurrency evidence in a way that holds up in an investigation? The sixteen content areas below follow the substantive modules of the current curriculum, numbered 02 through 17. Module 01 is orientation and module 18 is the final examination, so neither is treated as a content area here.
If you are still orienting yourself to the credential itself, our explainers on what CCFI is and what CCFI stands for cover the basics. For a broader preparation plan, pair this article with the CCFI study guide.
Foundations: Domains 1-4
The first four areas establish the vocabulary and technical background that every later area assumes. Candidates who skim these usually struggle when the scenario questions start asking them to reason about how a transaction actually works.
Domain 1: Introduction to Cryptocurrency
This area frames what digital assets are, how they differ from traditional money, and why they appear in criminal cases.
- Core terminology an investigator must use precisely in reports
- The difference between coins, tokens and other digital assets
- Why decentralization changes what evidence is available and who holds it
Domain 2: Anonymization Networks
Investigators routinely meet suspects who try to hide their network location. This area covers the tools used to obscure identity and the investigative limits they create.
- How anonymizing networks route and disguise traffic
- What an examiner can and cannot infer when these tools are in play
- How anonymity at the network layer differs from pseudonymity on a blockchain
Domain 3: Understanding Encryption
Cryptography underpins both the assets and the evidence. You need conceptual fluency, not the ability to design ciphers.
- Public and private keys and why key control equals asset control
- Hashing and digital signatures and their role in verifying transactions
- How encryption affects the acquisition of seized devices and data
Domain 4: Understanding Blockchain
This is the structural core. Expect scenario questions that assume you understand how blocks, ledgers and consensus produce a permanent public record.
- How blocks are linked and why altering history is impractical
- Public ledger transparency as an investigative advantage
- Different blockchain designs and what each exposes to an examiner
Transactions, Mining and Wallets: Domains 5-7
These three areas move from theory to the objects investigators actually examine: transactions, the process that confirms them, and the software or hardware that holds keys.
Domain 5: Bitcoin Transactions
Bitcoin is the reference case for tracing. Understanding its transaction structure is the foundation for nearly everything in the money-trail areas later on.
- Inputs, outputs and how value moves between addresses
- Change addresses and why they matter when following funds
- Reading transaction data to establish timing and relationships
Domain 6: Mining Cryptocurrency
Mining explains how transactions are confirmed and new units enter circulation. For investigators, it also matters as a source of legitimate-looking funds and a target of misuse.
- How mining secures a network and validates transactions
- Mining pools and the records or relationships they may create
- Illicit uses such as unauthorized mining on compromised systems
Domain 7: Cryptocurrency Wallets
Wallets are where evidence lives. This area covers wallet types and what each means for attribution and seizure.
- Custodial versus self-custody arrangements and who can be compelled to produce data
- Hardware, software and paper storage and the artifacts each leaves behind
- Recovery phrases and seed material as critical evidence
Key Takeaway
Domains 5 and 7 are tightly linked. A transaction tells you where value went; a wallet tells you who may control it. Practice moving between the two so a scenario question about an address leads you naturally to the evidence question that follows.
Smart Contracts and Investigation Methods: Domains 8-10
Domain 8: Smart Contracts & Tokens
Beyond simple payments, much modern activity runs through programmable contracts and token systems. Investigators need to recognize when value moves through logic rather than a plain transfer.
- How self-executing contracts work and where their code and history are visible
- Token standards and why token movements can be harder to read than native coin transfers
- Common abuse patterns involving contracts and token schemes
Domain 9: Cryptocurrency Investigation Methodologies
This is where technical knowledge becomes a repeatable process. Expect questions about how to structure an inquiry from first lead to defensible conclusion.
- Building an investigative plan around the data you have
- Combining on-chain evidence with traditional investigative sources
- Maintaining objectivity and documenting each step
Domain 10: Analysis of Recovered Addresses and Wallets
Once an address or wallet is recovered from a device or a lead, you must work out what it reveals.
- Extracting and validating addresses from recovered material
- Linking addresses to a wallet and to broader activity
- Assessing what an address history says about the holder's behavior
Domains 9 and 10 reward candidates who think like examiners rather than memorizers. If you want a realistic sense of how demanding the combined technical and procedural load is, see how hard the CCFI exam is.
The Money Trail and Criminal Activity: Domains 11-12
Domain 11: The Money Trail
Following funds across addresses and, eventually, to a point where real-world identity can be established is the signature skill of the credential.
- Tracing value hop by hop and recognizing where trails are deliberately broken
- Identifying exchanges and service endpoints where identity records may exist
- Presenting a trace as a clear, verifiable chain rather than a vague graph
Domain 12: Identification of Criminal Activity
Not every unusual transaction is a crime. This area teaches you to recognize the patterns associated with particular offenses.
- Behavioral indicators of fraud, extortion, illicit markets and similar activity
- Distinguishing suspicious patterns from legitimate but unusual use
- Connecting on-chain behavior to the underlying offense you would need to prove
Seizure, Case Files, Laundering and Law: Domains 13-16
Domain 13: Seizing Coins
Identifying assets is only useful if they can be secured. This area addresses how digital assets are taken into lawful custody.
- Securing keys and wallet access without altering or losing the assets
- Handling different storage arrangements during seizure
- Preserving the integrity of evidence while moving assets to controlled custody
Domain 14: Preparing Your Cryptocurrency Case File
A strong trace that is poorly documented fails in practice. This area covers building a file that others can review and rely on.
- Organizing transaction evidence, screenshots and analysis consistently
- Reporting findings in clear language for prosecutors and non-technical readers
- Recording methods so another examiner could reproduce your results
Domain 15: Money Laundering Schemes
Criminals rarely hold proceeds in the original address. This area covers how funds are layered and moved to obscure origin.
- Common laundering stages and how they appear on-chain
- Mixing, chain-hopping and rapid movement across services
- Indicators that help an investigator spot structured laundering behavior
Domain 16: Cryptocurrency Legal Aspects
The final area covers the legal framework surrounding evidence and process.
- Legal process for obtaining records from service providers
- Admissibility concerns and chain-of-custody expectations
- Jurisdictional complications when assets and actors cross borders
Exam Format, Fees and Eligibility
Knowing the content is half the preparation; the other half is understanding the mechanics. The table below summarizes the verified facts.
| Item | Detail |
|---|---|
| Administering body | McAfee Institute |
| Format | Multiple-choice, true/false and scenario-based questions |
| Length | 3 hours, single sitting, closed book |
| Delivery | Online, on demand, remotely proctored |
| Passing score | At least 70% |
| Standalone exam license | $450, one proctored attempt, valid one year |
| Retake license | $450 |
| Full training program | $2,497, with 40 hours of instruction, 40 CPE credits, study manual, quizzes, lifetime course access and a one-year exam license |
| Renewal | Every 2 years, $125, with proof of continuing professional education |
Experienced, eligible candidates may buy the exam separately without the full training program. Professional eligibility follows one of three paths: a bachelor's degree or higher with 4 years of relevant experience, an associate's degree with 6 years, or a high-school diploma or equivalent with 7 years. Qualifying experience is in investigations, law enforcement, criminal justice, military or a comparable field with direct criminal-investigation or intelligence responsibilities. Applicants must also meet identity, documentation, professional-suitability and criminal-background standards, and completing the training alone does not confer the professional credential. Our CCFI requirements guide walks through qualifying in detail, and the certification cost breakdown compares the training and exam-only routes. For the scoring rule, see the passing score article.
Sequencing the Domains in Your Prep
Because the areas build on one another, order matters more than raw hours. One workable approach is to move from foundations to workflow, saving the legal and documentation material for when you can anchor it to concrete cases.
Technical foundations
- Domains 1-4, with extra time on keys, hashing and ledger structure
- Be able to explain why key control equals asset control
Objects of examination
- Domains 5-7: transaction anatomy, mining, wallet types
- Practice reading a transaction and naming the evidence it implies
Method and tracing
- Domains 8-12, treating them as one investigative workflow
- Work scenarios that move from a recovered address to a suspected offense
Custody, documentation and law
- Domains 13-16, tying seizure and case-file steps to evidence integrity
- Finish with mixed scenario practice across all sixteen areas
Because the exam is closed book, reference-style notes are not an option on the day, so build recall of the core concepts. A compact review aid such as our CCFI cheat sheet helps consolidate must-know facts, and you can test yourself on scenario-style items in the CCFI practice tests. If you are weighing a structured course, the CCFI training overview explains what the program includes.
Where These Skills Get Used
The sixteen areas are oriented toward professional cryptocurrency investigation, not trading or victim-recovery services. The skills apply wherever digital-asset evidence appears in a case: law enforcement units, financial-crime and compliance teams, corporate security and investigations groups, and consultants who support legal matters. The eligibility paths above, which lean on investigative, law-enforcement, criminal-justice, military or intelligence experience, signal the audience the credential is designed for. To explore how the certification relates to career outcomes, read about CCFI jobs and the value analysis. Practice access is also available on the main CCFI Exam Prep site.
Key Takeaway
Think of the sixteen areas as one case from start to finish: understand the technology (1-8), apply a method to recovered evidence (9-10), follow the money and name the offense (11-12), secure and document it (13-14), recognize laundering (15), and operate within the law (16).
Frequently Asked Questions
No. They are unweighted preparation headings drawn from course modules 02 through 17 of the current McAfee Institute curriculum. The institute does not publish percentages per area, so prepare for all sixteen rather than prioritizing by assumed weight.
The institute describes multiple-choice, true/false and scenario-based questions. The exam is closed book, runs 3 hours in a single sitting and is delivered online on demand with remote proctoring.
A score of at least 70% is required. If you take the training route, you must also reach at least 70% on the required course sections and quizzes.
Experienced, eligible candidates may purchase the exam separately. The standalone exam license costs $450, includes one remotely proctored attempt and remains valid for one year. A retake license also costs $450.
No. Successful training completion alone does not confer the professional credential. You must also meet the experience-based eligibility paths and the identity, documentation, professional-suitability and criminal-background standards.