What Lawyers Should Look For in a Crypto Expert Witness

Blockchain data is public and rarely disputed. What gets attacked is the reasoning laid over it — and that is where the choice of expert decides the value of the evidence.

Crypto now appears in disputes that have nothing to do with crypto: civil fraud and asset tracing, insolvency, financial remedy proceedings, regulatory enforcement, prosecution and defence. In most of them the instructing lawyer must make a technical judgement they are not equipped to make — which expert to rely on, and whether the report in front of them will hold. This piece takes that judgement from both directions: how to test a prospective crypto expert witness before you instruct, and how to test an opposing expert's report once it lands.

Procedural requirements for expert evidence vary by forum — the form of any declaration, whether permission is needed, what must be disclosed about instructions, whether experts meet before the hearing. Confirm those locally. What follows is about substance, which travels.

What Actually Qualifies Someone as a Blockchain Expert Witness

The market is full of people who describe themselves as crypto experts. Few have produced analytical work that anyone adversarial has examined. Three things are commonly offered as credentials, and none of them is one on its own.

• "Years in crypto." Trading since 2013, running a node, or working at an exchange shows familiarity with an industry. It does not show the ability to reconstruct a transaction history, document the method used, and defend each inferential step under cross-examination.
• A vendor tool certification. It shows the candidate can operate the software. It says nothing about whether they understand what the software is inferring or where its heuristics fail. An expert whose opinion is whatever the tool displayed is an expert whose opinion collapses the moment someone asks how the tool reached it.
• Publications and conference appearances. Useful context, weak evidence. Ask about the analytical work instead.

What does qualify someone is demonstrable analytical work on chain and an articulable methodology. Can they explain, without the software in front of them, how they establish that a set of addresses is under common control, and what would falsify that conclusion? Have they worked the chains your matter involves — Bitcoin's UTXO model and account-based chains raise genuinely different analytical problems, and fluency in one does not transfer. Have they been cross-examined, and what happened? An expert whose method has never been tested is an unknown quantity, whatever the CV says. Accountancy or audit qualification adds a second layer, because valuation and reconciliation questions arrive alongside the tracing ones; our own work sits under ICPAC licensing for that reason.

Test Independence First

Test independence first, not last, because everything else is worthless without it. An expert instructed by one party still owes an overriding duty to the tribunal, above any duty to the party paying the fee. That is not a formality. It is the reason the evidence is weighed at all rather than treated as advocacy.

Ask how the expert has handled a case where the data did not support the instructing party's position. A candid answer describes telling the client early and privately, in time for the legal team to decide how to proceed. A candidate who says it has never happened has either not done much work or is not telling you the truth. Related tests: does any part of the fee depend on outcome or recovered assets, and is the same firm running conflicting work — a contingent recovery mandate, say, while also offering to opine on the same transfers?

What a Crypto Expert Report Must Contain

A report that holds up is one another competent expert could pick up and reproduce. The components are unglamorous and they are the whole game.

• Instructions and questions, reproduced, so the scope of the opinion is unambiguous and nothing has been answered that was not asked.
• Documented methodology. Chains, tools, data providers, block heights or snapshot dates, and each analytical step, in enough detail to be repeated. Transaction schedules exhibited, not summarised.
• Chain of custody. How each item was obtained, when, by whom, and how it has been preserved. On-chain data is verifiable at source; the report should record what a third party needs to verify it independently.
• Fact separated from opinion. "Address A sent 40 ETH to Address B at block 21,431,908" is observed fact. "Address B is controlled by the second defendant" is opinion resting on inference. A report that blurs the two will be taken apart line by line.
• Assumptions and limitations. Every point where the trail could not be resolved, where attribution rests on inference, and where an alternative explanation remains open — stated by the expert, before opposing counsel states it.
• Declaration of qualifications, independence, and the duty owed to the tribunal, in whatever form the forum requires.

The Four Soft Spots in Crypto Evidence

Overreaching in crypto reports concentrates in four places. Know them and you can read any report — yours or theirs — with the right scepticism.

Address clustering. Grouping addresses into a single controlled cluster relies on heuristics, most commonly common-input ownership and change-output identification. These are probabilistic inferences about behaviour, not proofs of control, and they are weakened by exchange batching, CoinJoin-style constructions, and unusual wallet software. A report should state which heuristics were applied and how confident each conclusion is. One that presents a cluster as a fact has skipped the step that matters.

Attribution to a named person or entity. The most common overreach in the field. On-chain data can show that an address behaves as part of a cluster and that value reached a named exchange. It cannot, by itself, show who held the keys when a transaction was signed. Attribution to a person almost always depends on off-chain corroboration — KYC records obtained through disclosure or a third-party order, device evidence, correspondence, an admission. Where a report attributes a wallet to a defendant, find the off-chain link. If it is a commercial dataset label, ask how and when that label was derived; vendor attribution databases are investigative leads, not evidence of identity.

Mixers and bridges. Different problems, often treated as one. A mixer or privacy protocol is designed to break the link between input and output; frequently no reliable path through exists, and the honest finding is that the trail ends there. Timing-and-amount correlation across a mixer can be legitimate analysis, but it is inference with a stated confidence, never a traced hop. Bridges are more tractable — a cross-chain transfer typically leaves a lock or burn event and a corresponding mint or release — but the correspondence must be evidenced transaction by transaction, not assumed because the amounts look similar.

Inference at unresolved hops. Some reports bridge a gap with language like "the funds were then transferred to" when what is meant is "an equivalent amount later appeared at." Watch the verbs. Each unresolved hop should be flagged, with the assumption used and its effect on the conclusion. A single unflagged hop can carry the entire chain of reasoning.

Questions to Put to a Prospective Expert

1. What is your duty when the on-chain evidence contradicts the case of the party instructing you, and when has that happened?
2. Describe a matter where your methodology was challenged. What was put to you, and what did you concede?
3. Which chains, protocols and asset types have you analysed in instructed work, and which are outside your expertise?
4. How do you establish common control over a set of addresses, and what would cause you to withdraw that conclusion?
5. What do you rely on for attribution beyond commercial dataset labels, and how do you express attribution confidence?
6. How do you handle a transfer into a mixer? When would you decline to trace through it?
7. Which tools and data sources do you use, and can you reach the same result through an independent source?
8. Could another competent expert reproduce your analysis from your report alone? Show me an anonymised example.
9. How do you record chain of custody over material we provide and over data you collect yourself?
10. What is your fee basis, and does any part of it depend on the outcome or on recovered assets?
11. Do you or your firm have any relationship with the parties, their advisers, or any platform involved? Run a conflict check before we go further.
12. Can you meet the timetable — report deadline, expert meeting, hearing window — and are you available to give oral evidence on those dates?

Questions to Probe an Opposing Report

Use these when reviewing the other side's report, preparing cross-examination, or briefing your own expert to respond. Most productive challenges to blockchain evidence come from the same short list.

1. Is the methodology set out in enough detail that an independent expert could reproduce the result? If not, the conclusions are assertions.
2. Are the transaction schedules exhibited, with hashes, timestamps and block heights, or only summarised in narrative?
3. Which statements are observed fact and which are opinion? Mark them up. The proportion is often revealing.
4. What clustering heuristics were applied, and are their known failure modes acknowledged?
5. On what basis is each wallet attributed to a person or entity — off-chain corroboration, or only a vendor label?
6. Where the report says funds "were transferred to" a destination, does the data show a traced path or a correlation of timing and value?
7. How were mixers and unresolved hops handled, and is each break in the chain disclosed?
8. For cross-chain movement, is each bridge transaction matched on both sides, or inferred from amount and timing?
9. Does the report treat off-chain movements inside an exchange as if they were on-chain transfers?
10. Are assumptions and limitations stated at all? A crypto report with no limitations section is not a careful report.
11. Do the conclusions exceed the questions the expert was instructed to answer?
12. Does the expert opine outside their expertise — on legal characterisation, intention, or a party's state of mind?
13. Are the data sources and date of analysis identified, and can the work be re-run today against the same chain state?
14. Is there an independence declaration, and does the fee arrangement or a prior relationship undermine it?

Practical Matters Before and After Instruction

Run the conflict check first, with the full party list including corporate vehicles and any exchange or custodian in the picture. Then write a letter of instruction that asks answerable questions. "Trace the stolen funds" is not answerable; "identify the destination of the 312 BTC transferred from the addresses at Schedule 2 between 3 and 9 March 2025, and state whether any part reached an identifiable service" is. Ambiguous instructions produce reports that miss the issue and hand the other side a line of attack about scope. Agree scope, fee basis and deadline in writing before analysis starts, and give the expert the full timetable, not only the report date. Urgent applications run to a different rhythm: a focused analysis for a freezing application, then a fuller report later.

Where each side has an expert, expect expert discussions and a joint statement. In crypto cases the technical gap narrows sharply at that stage, because both experts are reading the same public ledger; what remains in dispute is usually attribution and the confidence attached to inferences, which is exactly what should reach the hearing. By then the work that decides the outcome is months old. An expert with a documented method, stated assumptions and limitations disclosed on the face of the report is a hard target. One defending an undocumented method for the first time under questioning is not. Watch, too, for the expert who argues the client's case from the witness box. It reads as partiality and costs more than the point being defended.

How Ondology Labs Can Help

We are a blockchain forensics and auditing firm in Cyprus providing blockchain forensics and tracing, crypto asset recovery, and independent expert witness reports and court support for legal teams in Cyprus, Greece and across the EU. We accept single joint expert appointments, take part in expert meetings and joint statements, and attend to be cross-examined. Where a finding rests on inference rather than proof, we say so in the report — before opposing counsel does.

Related reading: Blockchain forensics in Cyprus and Greece.