In This Guide
- When to Engage a Crypto Investigator
- Investigator vs. Expert Witness: The Difference
- Privilege and Work Product Protection
- The Intake Process: What to Bring
- Scoping the Engagement
- Billing Structure and Retainer
- Deliverables by Litigation Stage
- Emergency TRO and Asset Freeze Support
- Coordinating with Counsel and Other Experts
- Frequently Asked Questions
When to Engage a Crypto Investigator
The single most common mistake attorneys make in cryptocurrency cases is waiting too long to engage a forensic investigator. Cryptocurrency is extraordinarily mobile. A sophisticated party who learns that litigation is coming — or who knows their assets may be subject to a court order — can move funds from an exchange to a self-custody wallet, through a mixer, across a bridge to another blockchain, and into a privacy coin within a few hours. Assets that were fully recoverable on Monday may be effectively untraceable by Friday.
Blockchain forensics is most powerful at the earliest stages, when the on-chain trail is fresh and when emergency remedies like TROs, asset freezes, and ex parte orders are still available. The right time to engage is:
- Before filing: For asset-intensive cases where you need a preliminary assessment to determine whether there is a recovery to pursue and whether emergency relief is warranted
- At filing: In TRO and preliminary injunction contexts, where the investigator’s preliminary report supports the declaration that assets are being dissipated
- During early discovery: To analyze exchange records produced in discovery, identify wallet addresses not disclosed, and trace pre-filing asset movements
- As expert disclosure approaches: To convert an investigative engagement into a formal Rule 26 expert report engagement before the disclosure deadline
Every day a crypto investigator is not on the case is a day the opposing party can move funds. If there is any possibility that cryptocurrency assets are at issue in your case, pick up the phone before you file. A 48-hour preliminary assessment costs a fraction of what a full engagement costs, and it may reveal whether emergency relief is warranted before assets disappear.
Investigator vs. Expert Witness: The Difference
Many attorneys do not realize that a blockchain forensic investigator can serve in two distinct roles, with very different privilege and disclosure implications.
Non-Testifying Consulting Expert
Under Fed. R. Civ. P. 26(b)(4)(D), a consulting expert who is not expected to testify at trial receives the strongest work-product protection. Their identity, communications with counsel, analysis, and conclusions are generally not discoverable absent exceptional circumstances. This role is appropriate when you want an investigator to assess the case confidentially, help you understand the on-chain evidence, and assist with discovery — without creating a disclosure obligation.
Testifying Expert Witness
When the investigator will offer opinions at deposition or trial, they become a retained testifying expert subject to Rule 26(a)(2)(B) disclosure requirements. The attorney must produce the expert’s full report, qualifications, prior testimony list, and compensation arrangement by the disclosure deadline. Draft reports and attorney-expert communications are protected under Rule 26(b)(4)(C), but the final report and all facts considered are fully discoverable.
Many engagements begin as consulting arrangements and convert to testifying expert engagements as the case develops. The decision to convert should be made well in advance of the disclosure deadline so the investigator has adequate time to prepare a complete Rule 26 report.
Privilege and Work Product Protection
The engagement structure determines the privilege protection available. The attorney should retain the investigator directly on behalf of the client, using a retention letter that explicitly invokes the work-product doctrine and, where applicable, the attorney-client privilege for communications made in anticipation of litigation.
Structuring the Retention
- The law firm retains the investigator, not the client directly
- The retention letter identifies the case, invokes work product protection, and specifies the investigator’s role (consulting vs. testifying)
- All communications between attorney and investigator go through attorney email, not directly client-to-investigator
- If the client will communicate directly with the investigator (e.g., to provide wallet information), establish a communication protocol in writing
Consulting-to-Testifying Conversion
When an investigator converts from consulting to testifying, their prior consulting-phase work product does not automatically become discoverable. The protection for the consulting phase survives the conversion. The testifying expert disclosure obligations apply only to the opinions the expert will offer at trial and the facts and data considered in forming those opinions. Prior analytical work done in the consulting phase that was not relied upon in the trial opinions remains protected.
The Intake Process: What to Bring
The quality and speed of the forensic analysis depends heavily on the completeness of the intake materials. Come to the first call prepared to provide:
| Material | Why It Matters |
|---|---|
| Known wallet addresses | Starting points for tracing. Include all addresses the opposing party disclosed and any identified through prior investigation. |
| Transaction hashes | The specific on-chain events you need analyzed. If you know the transfer happened, the hash eliminates ambiguity. |
| Exchange account records | KYC-verified exchange accounts tie a real identity to a wallet cluster. Even partial records are valuable. |
| The complaint or claim narrative | Context about the alleged fraud, timeline, and amount allows the investigator to scope the analysis correctly. |
| Hearing / disclosure schedule | Determines whether the engagement needs to prioritize a preliminary report, a full Rule 26 report, or trial preparation. |
| Opposing party information | Names, known business entities, any known cryptocurrency activity. Assists with entity attribution during analysis. |
Scoping the Engagement
After the intake call, a well-run forensic engagement begins with a written scope of work that defines the deliverables, the timeline, the data to be analyzed, and the fee structure. This document should be reviewed and approved by the attorney before substantial work begins.
Key Scoping Questions
- Single-chain or multi-chain? Ethereum-only cases are simpler than cases involving five blockchains and multiple cross-chain bridges. Multi-chain cases take longer and cost more.
- How many addresses? A case involving five known wallets is very different from one involving a 400-address cluster. Scope the address range before committing to a fixed timeline.
- What is the primary deliverable? A quick preliminary assessment, a full Rule 26 report, a forensic affidavit, or trial testimony? Each has different preparation requirements.
- What is the urgency? TRO support in 48 hours vs. a Rule 26 report in six weeks are very different engagements. Rush work is possible but commands a premium.
- Are there mixers or privacy protocols? If so, acknowledge upfront that tracing may be probabilistic rather than conclusive in certain segments of the trail.
Billing Structure and Retainer
Blockchain forensic investigators typically bill hourly against an initial retainer. The retainer is held in trust and drawn against as hours are worked. When the retainer is depleted, the attorney replenishes it. Unspent retainer funds are returned at the end of the engagement.
| Engagement Type | Typical Initial Retainer | Hourly Rate |
|---|---|---|
| 48-hour preliminary assessment | $1,500 – $3,000 | $300 – $600/hr |
| Forensic affidavit / declaration | $3,000 – $6,000 | $300 – $600/hr |
| Full Rule 26 expert report | $8,000 – $15,000 | $300 – $600/hr |
| Deposition preparation + testimony | $3,000 – $6,000 (additional) | $3,000 – $6,000/day |
| Trial testimony | $4,000 – $8,000 (additional) | $4,000 – $8,000/day |
Fixed-fee arrangements are available for well-defined deliverables (stand-alone affidavit, preliminary assessment, single-question tracing report). Full litigation engagements are almost always hourly because the time required depends on the complexity of the on-chain evidence, the opposing party’s conduct, and the procedural posture of the case.
Deliverables by Litigation Stage
A full-arc litigation engagement produces different deliverables at each stage of the case:
Pre-Filing
- Preliminary wallet assessment — confirms that assets exist and are traceable
- TRO declaration — supports ex parte application for asset freeze
- Case theory validation — confirms whether the alleged fraud matches the on-chain activity
Early Litigation
- Asset inventory report — full mapping of all wallets, balances, and exchange accounts identified
- Subpoena target list — identifies which exchanges hold relevant accounts for subpoena
- Discovery response review — analyzes opposing party’s wallet disclosures for completeness
Expert Disclosure
- Rule 26 expert report — complete opinions, methodology, exhibits, qualifications, prior testimony
- Exhibit package — transaction graphs, cluster maps, annotated blockchain screenshots
- Rebuttal report — response to opposing expert’s methodology and conclusions
Deposition and Trial
- Deposition preparation session — attorney-expert prep on methodology, anticipated questions, and demonstratives
- Trial demonstrative exhibits — jury-ready visual presentations of the on-chain evidence
- Direct examination outline — collaborative development with trial counsel
- Cross-examination preparation — the known attack lines against blockchain forensic testimony
Emergency TRO and Asset Freeze Support
The most time-sensitive forensic engagements involve emergency TRO or preliminary injunction applications. Courts granting asset freezes on cryptocurrency cases require evidence that: (1) cryptocurrency assets exist; (2) they are likely to be dissipated if not restrained; and (3) the applicant can demonstrate a likelihood of success on the merits.
A preliminary forensic declaration submitted with the TRO application provides the evidentiary foundation for elements (1) and (2). The declaration should include: identified wallet addresses and balances, evidence of recent movement consistent with dissipation, exchange account connections, and the investigator’s opinion on the probability that funds will be moved if not restrained.
For emergency engagements, provide the investigator with all available data immediately, set a clear 24- or 48-hour deadline for the preliminary declaration, and ensure the investigator understands the precise standard the court will apply in your jurisdiction.
Coordinating with Counsel and Other Experts
In complex litigation, the blockchain forensic investigator may work alongside other experts — a damages expert, a financial forensics accountant, a cybersecurity expert, or a digital forensics expert addressing device evidence. The attorney is responsible for coordinating these experts so that their analyses are consistent and their trial narratives align.
Common coordination points in cryptocurrency cases:
- Blockchain expert + financial forensics accountant: The forensic investigator identifies the wallets and traces the crypto; the accountant values the assets and traces the fiat conversions through bank records. Both need to agree on timing and valuation dates.
- Blockchain expert + cybersecurity expert: In hack cases, the cybersecurity expert addresses how the breach occurred; the blockchain forensic investigator addresses what happened to the assets after the breach. The handoff point is the wallet from which assets were exfiltrated.
- Blockchain expert + opposing expert: Expect the opposing party to hire their own blockchain forensic expert. Prepare your expert for the rebuttal process and share the opposing expert’s report as soon as it is received.