Expert reports and courtroom testimony · Lesson 4 of 5
Testimony and cross-examination
7 min read
Testimony is where a forensic finding meets people who were not there when it was made and who may be trying to undo it. A sound trace can lose its weight because the expert overstated it, could not explain it simply, or defended a weak link as if it were a strong one. This lesson covers how to prepare, how to explain crypto to a court, how to handle hypotheticals and concessions, and the challenges that come up again and again in tracing cases.
Preparing to testify
Preparation starts with your own report, because that is what you will be tested on.
- Re-read the report and the case file, including your contemporaneous notes. Know which appendix row supports each finding, and be able to find it quickly.
- Re-verify a sample of cited transactions against a node or an independent source, and check whether funds have moved since the data cut-off.
- List your weakest links before anyone else does: the change-detection call over four hops, the bridge match with three candidates, the label with a single source.
- Read the opposing expert's report and decide, point by point, where you agree, where you disagree and why.
- Deal with new information before the hearing: if records arrived after the report, issue an amendment (see the lesson Writing the forensic report) rather than revealing a changed opinion on the stand.
- Prepare the logistics: the disclosed exhibits and their versions (see Visual evidence for courts), how they will be displayed, and, for remote testimony, the link and a test session. Cross-border testimony by video link is common; the Second Additional Protocol to the Budapest Convention (Article 11) provides for taking testimony and statements from a witness or expert by video conference between Parties.
Being familiarized with the process, such as the layout of the court, the order of proceedings and how exhibits are handled, is generally acceptable. Rehearsing the content of answers with the party that instructed you is not, and in many systems it would undermine the evidence entirely.
How questioning works and how to answer
Who asks the questions varies: the party that called you, the other parties, the judge or panel, and in some systems the court leads all questioning. Your duty does not change with the questioner. The same answer should come out whoever asks.
Habits that work everywhere:
- Listen to the whole question, then pause. The pause gives you time and lets others object if they need to.
- Answer the question asked, not the one you expected. If it has two parts, say so and answer each.
- Speak to the decision-maker, not the lawyer, and keep answers short. Stop when you have answered.
- Ask to see the document you are being asked about, and take the time to read it.
- Say "I don't know" when you don't, and "I didn't examine that" when you didn't.
- Correct mistakes immediately, including your own earlier answers.
Explaining crypto in plain language
Analogies help a court grasp an unfamiliar system quickly, but every analogy breaks somewhere, and a good cross-examiner will find the break. Use them with their limits stated.
| Concept | Useful analogy | Where it breaks |
|---|---|---|
| Blockchain | A public ledger that anyone can read and nobody can alter after the fact | No bank or registrar stands behind the names; there are none |
| Address | An account number printed on every receipt, without the holder's name | One person can have thousands; one address can serve many customers at a service |
| Transaction ID | A receipt number that anyone can look up | It proves the transfer, not who pressed the button |
| Deposit address at an exchange | A personal payment reference at a bank | The exchange's own ledger, not the blockchain, shows which customer it belongs to |
| Clustering | Grouping accounts because they are always used together | It is a rule of thumb with known exceptions, not a record of ownership |
The safest explanation separates what is recorded from what is inferred, in the same words as the report: "This transfer is recorded on the blockchain; anyone can check it. That this address belongs to Exchange K is my opinion, and here is why."
Staying within the report
The report is the boundary of your evidence. New opinions introduced on the stand surprise the other party, could not have been reviewed, and are often excluded or given little weight. If you are asked about something you did not analyze, say so, explain what analysis it would need and how long, and do not improvise a trace in the witness box. If you are shown a fact you did not know, say whether it could affect your opinion and how, rather than defending the opinion by reflex.
Handling hypotheticals
A hypothetical asks you to assume facts and give an opinion on them. Hypotheticals are legitimate: they test whether your conclusions depend on assumptions. Handle them in four steps: restate the assumption, identify which finding depends on it, answer conditionally, and decline if an answer would need analysis you have not done.
Q: Assume the exchange reused that deposit address for a second customer.
Would your conclusion change?
A: If that assumption is correct, it affects Finding 3 only. My opinion
that the funds reached Exchange K would not change. My opinion that
they reached the account of the person named in the exchange records
would: I would need the exchange's records for both customers to say
which account was credited. Findings 1 and 2 do not depend on it.The answer restates the assumption, ties it to one finding, explains what changes and what does not, and names the evidence that would settle it. It neither refuses the hypothetical nor lets it spread to findings it does not touch.
Conceding limits
Concede what is true, promptly and plainly. An expert who resists an obvious point loses credibility on everything else. Concessions are much easier when the report graded its findings separately, as the lessons Tracing to an evidential standard and The expert's role and duties recommend: conceding that a heuristic link is uncertain does not touch a deterministic transfer two pages earlier. A useful formula is "Yes, that is a limitation; it affects this finding in this way; it does not affect these other findings, because…". If you discover an error in your own report, say so at once, explain its effect and, if the court allows, provide a correction in writing.
Common cross-examination lines on crypto tracing
The technical substance of these challenges, and how to prepare the material to meet them, is covered in the lesson Disclosure and defense scrutiny. In the witness box they tend to arrive in recognizable forms:
| Line of attack | Typical question | What a sound answer does |
|---|---|---|
| Address is not a person | "You can't say who controlled this address, can you?" | Agrees; points to the separate evidence for control (exchange records, device artifacts) and who provided it |
| Heuristic error | "Isn't the common-input heuristic wrong for CoinJoin transactions?" | Agrees it has exceptions; says which were checked and how; gives the grade assigned |
| Tool opacity | "You relied on a commercial label you can't explain?" | Names the label source and date; describes the independent corroboration, or concedes its absence |
| Method choice | "Under a different tracing method, less money reaches my client's account?" | Confirms the range; explains why the method was chosen and that the report shows both |
| Coincidence | "Lots of transfers happen at that amount and time, don't they?" | Gives the candidate count in the stated window and the grade that follows from it |
| Data provenance | "You got this from a website anyone can edit?" | Explains the node or dataset used, block hashes, and that any examiner can re-verify |
| Independence | "You work for the agency that brought this case?" | Acknowledges it; describes peer review, re-performance and how context was managed |
| Competence | "Have you ever testified on cross-chain bridges before?" | Answers factually; describes relevant training and casework, and stays within it |
Notice what the good answers share: they agree with what is true, give a specific fact rather than a general assurance, and keep each concession attached to the finding it concerns.
Exam focus: preparation steps (re-read report and notes, re-verify transactions, list weak links, read the opposing report, amend before the hearing, prepare exhibits and video links); cross-border testimony by video conference under the Second Additional Protocol to the Budapest Convention; familiarization versus rehearsing answers; answering habits (listen, pause, answer what was asked, short answers, "I don't know"); analogies and where they break; not introducing new opinions on the stand; the four steps for hypotheticals; conceding limits finding by finding; recognizing common cross-examination lines and the pattern of a sound answer.