Former NCA Officer Ordered to Repay $2.4M After Stealing 50 Bitcoin Worth $77K in 2017

Table of Contents

• You might want to know
• Main Topic
• Key Insights Table
• Afterwards...

You might want to know

• How did an officer assigned to a dark web investigation gain access to and move seized cryptocurrency without detection for years?

• What legal and investigative tools allowed prosecutors to recover assets and secure a confiscation order long after the theft occurred?

Main Topic

A UK court has ordered a former National Crime Agency (NCA) officer, Paul Chowles, to repay £1,810,678.93—approximately $2.4 million—in relation to the theft of 50 Bitcoin that were seized during an investigation into the dark web marketplace Silk Road 2.0. The coins were taken in 2017 and at that time had an approximate value of £60,000 (about $77,000), but appreciable growth in Bitcoin’s market price contributed to the much larger confiscation figure now enforced under the Proceeds of Crime Act 2002.

Chowles, 44 and formerly assigned to the NCA team investigating Silk Road 2.0, had responsibility for analyzing seized devices and extracting cryptocurrency held in wallets associated with that investigation. Prosecutors say he moved 50 BTC out of a wallet belonging to Thomas White’s Silk Road 2.0 operation and attempted to conceal the destination of the funds. Over time, some of the stolen coins were split, routed through mixing services, and cashed out using various methods.

Law enforcement eventually recovered 30 of the 50 BTC from Chowles. The confiscation order covers the recovered coins and applies a valuation that reflects Bitcoin’s appreciation between 2017 and the date of the order. The Crown Prosecution Service (CPS) attributes the difference between the original value at the time of the theft and the amount ordered for repayment to that market appreciation, a common approach in proceedings under asset-recovery legislation.

Investigators say the coins originated from White’s reserve wallet across two separate days in May 2017. The defendant allegedly fragmented the total into smaller transfers, routed funds through a cryptocurrency mixing service known as Bitcoin Fog to obscure the trail, and cashed out via Cryptopay and Wirex debit cards. Authorities documented cash-out activity consisting of 279 transactions totaling £144,580.

For several years, the missing coins were blamed on the marketplace operator and were considered effectively untraceable. White consistently denied responsibility. The case took a turn after a 2022 search of Chowles’ residence uncovered devices containing private keys that provided access to the funds. Merseyside Police, aided by blockchain analytics from Chainalysis, traced transfers through the mixer and linked holdings to the former officer.

Chowles pleaded guilty to theft, transferring criminal property and concealing criminal property. In July 2025 he was sentenced at Liverpool Crown Court to five years and six months in prison and subsequently dismissed from the NCA on 11 July 2025. Prosecutors emphasized that the defendant abused a position of trust to benefit personally from assets that had been seized in the course of a criminal investigation.

The CPS’ Proceeds of Crime Division secured the confiscation order under the Proceeds of Crime Act 2002 and also obtained a compensation order for the victim in the matter. Luke Clements, a specialist prosecutor in the division, said the CPS would continue to pursue offenders’ assets vigorously. Over the preceding five years the division reported recovering more than £530 million through confiscation orders and returning over £102 million to victims, citing those figures to underscore the agency’s emphasis on asset recovery.

The investigation illustrates several notable points about cryptocurrency-related crime and law enforcement responses. First, it highlights how insiders with privileged access to seized data and wallets can exploit procedural gaps to divert assets. Second, it shows that blockchain analytics and cooperation between police forces and specialist firms can overcome attempts to hide funds through mixers, especially once private keys or other direct evidence are recovered. Third, the case underscores how rapidly appreciating asset values can significantly increase the scale of confiscation orders when courts quantify the proceeds of wrongdoing.

Authorities say the case against Chowles involved comprehensive tracing efforts. Chainalysis and other forensic tools enabled investigators to follow the flow of funds despite attempts to obfuscate their path. Recovery of private keys in a search was a critical turning point, allowing direct control of the addresses and enabling seizure and valuation of a portion of the stolen holdings. The recovered 30 BTC factored into the confiscation calculation alongside broader monetary assessments required by the Proceeds of Crime Act.

Beyond the technical tracing and legal mechanisms, the case prompted institutional responses. The NCA dismissed Chowles following his conviction, and the CPS highlighted that pursuing financial redress—both confiscation and compensation—remains central to justice for victims and for upholding public trust in law enforcement institutions. The order to repay more than £1.8 million serves as both restitution and a deterrent signal to potential internal bad actors.

Finally, the case fuels ongoing debate over the efficacy of cryptocurrency mixers in shielding illicit transfers, the balance between privacy and traceability on public blockchains, and the protocols needed when law enforcement handles seized digital assets. While some view mixers as tools for legitimate privacy, prosecutors and investigators argue that they are commonly used to launder proceeds and that new standards and controls—combined with improved auditing of custody practices—are needed to prevent insider theft.

Key Insights Table

Afterwards...

Looking forward, the case reinforces the importance of stronger custody, audit and oversight procedures for seized digital assets within law enforcement agencies. It also highlights the increasingly effective role of blockchain analytics in unravelling attempts to launder or hide crypto proceeds. Policymakers and agencies may respond with updated protocols, mandatory logging of access to seized wallets, and improved inter-agency cooperation to prevent insider diversion.

For practitioners and observers, the outcome demonstrates that theft of digital assets can be reversible when investigations secure direct evidence—like private keys—and leverage forensic tracing. Confiscation orders that account for market appreciation send a clear message about financial accountability. The balance between privacy-enhancing tools and law enforcement’s ability to trace illicit funds will remain a key area of legal and technical development.