Interview scorecard template

Cryptocurrency Forensics Investigator interview scorecard

Evaluate Cryptocurrency Forensics Investigator candidates across 4 weighted areas: method and rigour, real casework, interpretation and judgement, and reporting and testimony. Method and rigour leads at 35%, so check how they trace funds: UTXO clustering heuristics, change address identification, peel chains, EVM trace parsing, and whether they verify Chainalysis or TRM attributions. Use the rubric to compare role-specific evidence consistently.

See AI scoring
science investigationaml investigationsblockchain tracingchainalysiswallet clustering
TL;DR
For method and rigour, look for evidence the candidate names specific heuristics and their failure modes, cross-checks vendor attribution against explorers or node RPC before asserting wallet ownership. For real casework, look for evidence the candidate recounts named case types with amounts traced, exchanges subpoenaed, and outcomes such as freezes, seizures, or filed reports. Apply the written 1–5 anchors to every answer, record the evidence behind each rating, and use the factor weights to reach a consistent overall assessment.
Complete evaluation framework

What to assess and how to score it

Review the evidence signals before interviewing. Then use the anchored descriptions—not instinct alone—to choose the score that best matches each answer.

01
Evaluation factor

Method and rigour

35% weight

Check how they trace funds: UTXO clustering heuristics, change address identification, peel chains, EVM trace parsing, and whether they verify Chainalysis or TRM attributions against raw block data.

Evidence to listen for

  • Follows and can justify an established methodology
  • Understands contamination, bias, and chain of custody as they apply to the field
  • Knows the limits of their techniques and says so
  • Documents procedure so results are reproducible and defensible

Five-point scoring guide

1
Poor

Careless method; unaware of contamination, bias, or procedural integrity.

2
Needs Improvement

Knows procedures but applies them inconsistently; gaps in documentation.

3
Satisfactory

Sound standard practice; less certain outside familiar techniques.

4
Very Good

Rigorous and well documented; understands the limits of each method.

5
Excellent

Names specific heuristics and their failure modes, cross-checks vendor attribution against explorers or node RPC before asserting wallet ownership.

02
Evaluation factor

Real casework

25% weight

Ask for real matters worked: ransomware payment tracing, exchange hacks, darknet vendor cases, seizure support, or SAR-driven reviews, including volumes traced and subpoena or VASP requests issued.

Evidence to listen for

  • Brings specific cases, sites, or projects rather than general description
  • States their own role and what they personally handled
  • Can describe an ambiguous or degraded case and how they proceeded
  • Knows what happened to the work afterwards

Five-point scoring guide

1
Poor

No hands-on casework; experience is entirely academic.

2
Needs Improvement

Limited exposure; cannot describe their own contribution clearly.

3
Satisfactory

Real casework with adequate detail; ownership sometimes vague.

4
Very Good

Specific cases with clear personal scope and outcomes.

5
Excellent

Recounts named case types with amounts traced, exchanges subpoenaed, and outcomes such as freezes, seizures, or filed reports.

03
Evaluation factor

Interpretation and judgement

25% weight

Probe judgement where trails break: Tornado Cash or CoinJoin obfuscation, cross-chain bridge hops, Monero exits, and how they express confidence rather than overclaiming attribution.

Evidence to listen for

  • Separates what the evidence shows from what they infer
  • States confidence levels and what would change their conclusion
  • Comfortable saying the result is inconclusive
  • Handles pressure to reach a preferred conclusion without bending

Five-point scoring guide

1
Poor

Overstates findings; no separation of evidence from inference.

2
Needs Improvement

Reaches conclusions the evidence does not support; uneasy with uncertainty.

3
Satisfactory

Reasonable judgement; qualifies findings when prompted.

4
Very Good

Clearly separates evidence from inference and states confidence unprompted.

5
Excellent

Distinguishes proven flows from inference, states confidence levels explicitly, and explains when mixer demixing claims should not be relied on.

04
Evaluation factor

Reporting and testimony

15% weight

Assess written and courtroom output: affidavits supporting search warrants, chain of custody for wallet and seed phrase evidence, exhibit-ready graphs, and any deposition or expert testimony experience.

Evidence to listen for

  • Writes findings that a non-specialist can act on
  • Has presented or defended work to an external audience: court, client, review board, publication
  • Withstands challenge without overclaiming or retreating
  • Keeps records that hold up to scrutiny

Five-point scoring guide

1
Poor

Cannot communicate findings; records would not withstand review.

2
Needs Improvement

Reporting is unclear or incomplete; avoids external scrutiny.

3
Satisfactory

Adequate reports; limited experience defending work externally.

4
Very Good

Clear reporting and real experience presenting to an external audience.

5
Excellent

Produces exhibits a non-technical juror follows, documents custody rigorously, and has withstood cross-examination or defence expert challenge.

Evidence-led prompts

Interview questions for a Cryptocurrency Forensics Investigator

Use these prompts to surface evidence for the weighted factors above and compare candidates against the same role-specific criteria.

  1. 01

    Can you describe a challenging case you solved involving cryptocurrency?

  2. 02

    Describe your experience working with law enforcement on cryptocurrency cases.

  3. 03

    How do you approach the investigation of ransomware cases involving cryptocurrency?

  4. 04

    What methods do you use to trace cryptocurrency transactions?

  5. 05

    Can you explain the concept of chain hopping and how you investigate it?

See the complete Cryptocurrency Forensics Investigator question set
Put this rubric to work

Score every candidate against the same standard

Add these weighted factors to Hirevire and let AI evaluate recorded answers against your rubric.

Explore AI Scorecards