As cryptocurrency adoption has grown, there has been increasing demand from legal professionals for expert witnesses that are qualified to opine on nuances involving cryptocurrency in court. Yet cryptocurrency is such a new and burgeoning field, which most people, including lawyers and judges, lack an elementary understanding of. Legal professionals have struggled to find qualified experts and often aren’t sure what to look for, so in this article, we discuss the appropriate credentials, experience, expertise and background one should consider if an expert witness with Bitcoin, cryptocurrency, or blockchain expertise is needed.

Types of Cases Requiring Cryptocurrency Experts

There are a very wide range of cases where expertise involving blockchain, Bitcoin or cryptocurrencies has been sought and as one might expect, given that cryptocurrency is a form of money, many (but certainly not all) of these cases have involved the wrongful movement of those funds. These cases have included:

• Frauds of various types – Investment fraud, securities fraud, ‘exit scams’, Ponzi schemes
• Embezzlement and misappropriation of funds (whether by suspect ICOs, VCs, etc.)
• Intellectual property litigation, which sometimes involves the use of patented or private blockchains or blockchain technology
• Cryptocurrency thefts and hacking
• Ransomware cases – ransomware cases have increased dramatically in the past couple of years. In some cases, the company pays out of pocket, while in other cases, if the company has cyber insurance, their insurer is left to foot the bill.
• Hidden and/or non-disclosed assets, such as in a divorce or business relationship
• Suspect ICOs – ever wonder how the founders of those ICO projects managed to buy all those Lambos before even having a working product?
• Anti-money laundering, compliance/regulatory, and due diligence
• Insurance, given that businesses are increasingly choosing to obtain loss insurance, however, one common exclusion of liability is if an insider was involved in the theft
• Business / Asset valuation – primarily for cryptocurrency businesses
• Negligence (particularly, lawsuits involving exchanges and other service providers)

As you can probably tell, most (but not all) of the cases that experts are sought for that involve Bitcoin or cryptocurrency could generally be categorized as investigative in nature. Thus, even if one has an extremely intricate understanding of the technology behind cryptocurrencies, and perfectly understands all the relevant concepts it still doesn’t necessarily qualify them as an expert in such cases, because that expertise must extend to investigative knowledge and experience. Thus, a cryptocurrency expert witness is rarely sought to merely explain the nature of cryptocurrencies themselves, and one must first ponder what type of cryptocurrency expert is needed. Since in most cases investigative experts or analysts are sought as cryptocurrency experts, in this article we generally focus on the qualifications and appropriate expertise an expert should have in this domain. But first, I want to discuss some of the common conceptions legal professionals, in particular, some litigators believe that an expert should have in this industry, including applicable backgrounds and appropriate credentials, and why those assumptions are sometimes without good merit.

Chartered Professional Accountants (CPA’s) and Forensic Accountants. 

Forensic accountants are traditionally called upon to investigate and explain financial crimes to courts that involve fiat currencies or traditional financial assets including various types of financial securities. Thus, it would be logical to assume some would reasonably be able to track cryptocurrency as well. However, while many forensic accountants certainly find cryptocurrency interesting, most recognize they lack the expertise to properly trace cryptocurrencies. A small portion of forensic accountants claim to have ‘expertise’ at tracking cryptocurrencies, but at CipherBlade we have yet to encounter a single forensic accountant that even has a basic understanding of blockchain forensics, much less the necessary expertise and tools to properly track funds and conduct investigations in this sector. Put simply, following cash financial trails with bank statements is a whole different animal relative to following blockchain trails, complete with different rules, methodologies, and tools.

Generally speaking, forensic accountants are capable of both reading and understanding account statements obtained from cryptocurrency exchanges but are generally not qualified to investigate further about what happened outside of the statement itself such as where the suspect sent funds, and where cryptocurrency held by the suspect resides currently and/or identify other services money was sent to or laundered through. There are certainly some cases where a forensic accountant can add value as an expert such as when deciphering an account statement itself is the only issue at hand (and no on-chain investigation is needed) but those cases are relatively few and far between in our experience.

Cryptography Professionals and Academics

Those with a PhD in Applied Cryptography (or similar) are sometimes sought as experts as some people (incorrectly) assume that someone with expertise in cryptography is necessarily knowledgeable and suitable as an expert in cases involving cryptocurrency given the similarity in the name along with the fact those cryptocurrencies do, of course, utilize cryptographic algorithms (among a plethora of other technologies that many laypeople are unaware of). 

But having an understanding of cryptography doesn’t help whatsoever in such investigations. It helps to understand a small portion of the many technical building blocks underlying cryptocurrencies. For example, it would be quite rare for a court to need a detailed technical explanation of the features of elliptic curve cryptography. There are cases where understanding these technical building blocks is useful, such as in some IP litigation cases, but those only make up a small minority of cases; a cryptography expert will likely only be able to explain a small portion of the technical building blocks of cryptocurrencies anyways. The reality is most cases that go into litigation involving cryptocurrency are investigative in nature, and that’s generally not something in the domain of someone with expertise in cryptography or other mathematical fields.

This is not to suggest that a cryptography expert is ill-suited should they also obtain investigative experience and expertise. If they also have a wealth of knowledge and experience in this regard, they can be perfectly well-suited to act as an expert in investigative cases involving cryptocurrency. But the notion that a cryptography expert without investigative (particularly, blockchain forensics) expertise is well-suited to offer a relevant opinion in litigation of a cryptocurrency case that is investigative in nature simply because of their cryptography degree is deeply flawed.

Computer Science Professionals

Those with a Computer Science degree (or similar) are also sometimes sought as experts in cases involving cryptocurrency. There’s no doubt that computer science professionals make up a relatively large number of cryptocurrency enthusiasts, relative to the number of computer science professionals that exist. But this background, while it might help them to better understand how Bitcoin works from a technical level, still adds nothing to their credentials as an investigative expert for cases that involve fraud, money laundering, theft, which is of course what the majority of cryptocurrency-related litigation involves.

A computer science background is a perfectly reasonable background to have should an individual want to gain experience in cryptocurrency investigations, but the degree in no way qualifies them as an investigative expert.

However, there are definitely some non-investigative cases where a computer science professional would be well-suited to offer an expert opinion. For example, take a cryptocurrency mining firm whereby operators allegedly grossly mismanaged equipment and resources causing significant losses, and damages are thus sought on the grounds of negligence. A cryptocurrency mining expert (many of whom have computer science degrees) would be well-suited to offer an expert opinion in this regard as they may be able to outline best practices and demonstrate how the operators were incompetent. But if there are allegations that the mining operators allegedly embezzled company earnings, a cryptocurrency mining expert, with or without a computer science degree, is ill-equipped to offer expert opinion on such a matter.

Blockchain “Investors”, “Advisors”, and “Consultants”

We all know the profile of the self-proclaimed “expert”. 20k Linkedin followers. No clear indication of what they’ve ever done – just acted as an ‘advisor’ or ‘consultant’ or works in “business development”. They often indicate they’ve “been in Bitcoin since *pick year here*” (typically 2009-2013) to show that they have been ‘involved’ in Bitcoin for longer, thus trying to cement their ‘expertise’. They often include multiple irrelevant credentials after their name. These should all be giant red flags that indicate an individual isn’t well-suited to offer any expert opinion on any case involving blockchain or cryptocurrency, whether investigative in nature or not.

As the current state of the blockchain industry is that the majority of discussion (and, arguably, money) for the industry stems from speculative (in particular, retail) investment, it follows suit that many popular “influencers” are those discussing exchange rates of cryptocurrency (appealing to the “when moon, when Lambo” crowd) and share little more “knowledge” than (often questionable) reading of charts.

Educational Credentials

Generally speaking, in order to get accredited as an expert, courts often look at educational credentials held by an expert. This is often why people offering expert services tend to obtain a slew of credentials, as it helps affirm to a court that they are indeed an expert and makes it easier to be certified by the court as such. But when it comes to cryptocurrency, there really aren’t any credentials that qualify someone as an expert. Pretty much any educational credential an individual has ought to be considered irrelevant.

No these credentials don’t help to cement one as an expert in cryptocurrency cases; they are completely irrelevant

Educational background aside, what educational credentials should an individual have if acting as an expert witness on investigative cases where cryptocurrency is a key component? One credential that exists is the Certified Bitcoin Professional (CBP) credential. Unfortunately, this credential is nearly useless in the context of investigative cases involving Bitcoin. Having this credential would help affirm that an individual has preliminary knowledge about Bitcoin itself and its underlying technology at a very basic level, but doesn’t suggest whatsoever that the individual would be qualified to investigate cases involving cryptocurrency at all. So for the purposes of acting as an expert witness in cryptocurrency cases, it’s generally a useless credential to have. Only some elements of CBP apply to blockchain forensics, such as an understanding of address types, inputs/outputs, and basic concepts such as co-spending and change addresses.

In CipherBlade’s opinion, there are currently no worthwhile educational credentials one could attain that would confirm them as a cryptocurrency investigative expert. Courts have started to recognize this, and experts must instead rely on other aspects of their background to cement them as an expert.

Chainalysis Reactor Certification (CRC)

There is, however, one semi-related credential that can be obtained. The Chainalysis Reactor Certification (CRC) is a credential individuals can obtain that ‘certifies’ they understand the basics of the blockchain forensic software tool ‘Reactor’. While this certification may prove helpful, there are limitations to its usefulness as a credential:

1. First and foremost, the training is about learning how to use the software tool itself. No training is a viable substitute for years of experience with a tool or investigations – no certification is offered anywhere that would qualify an individual as an experienced analyst (we’ve taken a look at the few that claim this and they’re extremely questionable). So having the CRC certification essentially confirms an individual knows the mechanics behind how to use the software but does not verify expertise. It does not suggest they know how to properly use it to conduct many types of investigation.
2. The CRC certification is primarily made available to law enforcement and select cryptocurrency businesses such as exchanges, as well as CipherBlade. One cannot simply get access to the software just because they are willing to pay for it without first qualifying for it, and they’d need to have an acceptable reason for needing such software. Even if the software was made available for anyone with deep enough pockets to pay for it, having access to the software wouldn’t qualify one as an expert, since a bad or improperly trained analyst can easily misuse the software and make mistakes that lead to dangerously incorrect conclusions, as happened quite recently when it was (incorrectly) reported that ISIS had a 300M USD ‘war chest’.
3. The CRC exam is quite easy; almost everyone who takes it passes. Chainalysis runs a fantastic course and does not set students up for failure. The questions asked are at an appropriate level of difficulty for somebody a couple-of-days-familiar with Reactor.

Nonetheless, despite these limitations, if an investigator wants to get a credential to add on their resume, the CRC certification is still currently the best one that can be obtained, which is why 5 CipherBlade personnel have it and why CipherBlade has offered crucial insight to help improve the CRC certification, and people have reached out to CipherBlade to understand how to most effectively utilize software in their internal investigations.

Requisite Experience and Expertise for Cryptocurrency Investigative Experts

So what background, experience, and knowledge should a cryptocurrency expert witness have? There are quite a few must-haves across all cases, while some areas of expertise are only needed in a portion of investigative cases.

Blockchain Forensics Expertise

An expert witness must have a fundamentally strong grasp of blockchain forensics and analytics, which very, very few people have. They must have access to the right blockchain forensics tools to conduct investigative work (not all tools are created equal, some are very poorly designed and rife with problems, which can lead the expert to make incorrect assumptions).

Even if they have access to, and know how to properly use the right tools, that still doesn’t qualify them as an expert. The tools themselves are just that; tools. The analysis is still up to the analyst; there are good analysts and bad analysts. An ‘expert’ is only suitable to act as an expert if they understand how to properly investigate cases involving cryptocurrency, and that requires ample experience utilizing blockchain forensics in investigations.

Inversely, under a hypothetical somebody had all of a “good expert’s” knowledge transplanted into their brain, without access to a solid blockchain forensics tool, performing all of the analysis required with just a blockchain explorer or free tools would result in a multiplier of hours ghastly higher than an equivalent individual with the same knowledge and access to a solid forensics tool. These tools, as discussed, are not cheap.

In short: the day-trader that knows how to click around on Blockchain.info and Etherscan is not a blockchain forensics expert, and don’t be tempted by the fact their proposed hourly rate is a third of the cost of a good expert’s hourly rate.

Contextual Knowledge

By contextual knowledge, we refer to the type of knowledge many avid cryptocurrency enthusiasts would have, but those outside the cryptocurrency space generally would not know, and would not be found in any cryptocurrency-related course i.e. details that are only known by insiders and not outsiders.

Some people may overlook the importance of this, but in CipherBlade’s opinion, the importance of having contextual knowledge as an investigative expert cannot be understated. As but one of the thousands of possible examples, let’s say a bunch of sub-2 BTC withdrawals are observed from Binance to a given wallet over a period of time. What would be the significance of this in an investigation? If you’re both an avid cryptocurrency user and have an investigative leaning, you probably already know the answer; 2 BTC is the maximum amount that can be withdrawn from a non-KYC account on Binance every 24 hours. Thus if there are a bunch of 2 BTC or sub-2 BTC withdrawals, this would be indicative of money laundering; someone washing funds through Binance as quickly as they can without undergoing KYC; specifically, the utilization of multiple accounts for structuring. However, someone not actively involved in cryptocurrency would likely not be aware of many of the thousands of highly important nuances just like this. Even the best tools wouldn’t flag a wallet or cluster of wallets with this example; these are the fine details an (actual) expert will find.

The above example is precisely why only those with ample contextual knowledge involving cryptocurrency are suited as investigators. In order to have all the necessary contextual knowledge, one needs to be entirely focused on cryptocurrency, both in their professional life and also in their personal life. This is one of the many reasons a forensic accountant generally cannot genuinely claim to be a suitable expert. They lack the requisite contextual knowledge since most of their work is focused on accounting for traditional financial assets. Furthermore, if they don’t own or use Bitcoin regularly in their day-to-day lives, perhaps because they are simply not interested in it for personal reasons, or because they think Bitcoin is a scam, it makes them doubly unqualified to act as an expert. An individual really needs to be an avid cryptocurrency enthusiast to be a good cryptocurrency expert witness.

Security, CyberSecurity and OPSEC (Operational Security)

Security is a fantastic background to have as an investigative expert in this field. This is because in many of the cases that require an expert witness, a security breach is involved. In some cases, it’s technical like malware, in other cases less technical like phishing, SIM-swapping, or a compromised login, while in other cases it involves understanding precisely how confidential information (e.g. a seed phrase) was accessed by a third party. There is no shortage of ways that security breaches occur, and all ultimately boil down to a failure of security.

Digital Forensics, Device Forensics and Open Source Intelligence (OSINT)

These skills and areas of expertise aren’t directly related to cryptocurrency itself, but they’re great skills and expertise to have for cases of this nature and they are almost always utilized during investigations to uncover key intelligence because good investigations encompass both on-chain forensics and off-chain elements as well. For example, while there are on-chain methods that may suggest a given individual controls an applicable wallet address, an investigator might also uncover a pseudonym the individual in question was known (to was discovered) to have utilized and was able to uncover a forum post whereby the pseudonym states a wallet address of theirs. Digital forensics and device forensics play very important roles in such investigations as well.

These skills generally require very minimal Cryptocurrency expertise but such skills are highly useful for any cryptocurrency expert witness to have and are factors that legal professionals should consider before hiring an expert

Summary

When seeking a cryptocurrency expert witness, first consider the nature of the case for which an expert is needed, as the cryptocurrency space itself is vast and growing exponentially. Avoid experts who indicate they have general ‘expertise’ or a padded CV with credentials that are effectively useless. Instead, focus on the nature of the expertise possessed by the expert themselves. Based upon the early stages of this industry, there is far more demand for (legitimate) experts than there is supply, so “you get what you pay for” will apply.