NCA officer jailed for stealing and laundering 50 BTC: how was it recovered?

A former UK National Crime Agency (NCA) officer has been jailed for five and a half years for stealing 50 bitcoins, which are now worth almost $6 million. The cryptocurrency was seized as criminal property during the Silk Road 2.0 investigation. The bitcoin was traced despite being laundered through a “mixer.”

Since 2013, the authorities have been investigating and targeting major dark web marketplaces known as Silk Road 1 and 2. These crypto-powered criminal networks enabled criminals to sell drugs and other illegal goods.

Paul Chowles, 42, was part of the NCA investigation, who later executed a shocking betrayal.

Silk Road 2 was launched by a criminal, Thomas White, who was identified in 2014, less than a month after the FBI had shut down the original site. White owned a “retirement wallet” with 97 bitcoins in it.

Chowles took the lead in seizing devices from White, analyzing and extracting relevant data and cryptocurrency. It was noticed that 50 bitcoins had been taken from the digital wallet between 6th and 7th May 2017, according to the Crown Prosecution Service’s (CPS) press release.

The transfer was initially undetected, but it left a permanent record on the blockchain.

The NCA investigation team assumed that White somehow managed to access the wallet and remove the bitcoin. By late 2021, the lost money had been written off as it was deemed untraceable, and the remaining 47 BTC were sold for more than one million pounds.

While under investigation, White himself noticed that someone had stolen 50 bitcoin. He assured that it had to be someone within the NCA who had the private keys to his crypto wallet.

White completed a custodial sentence in early 2022, and Merseyside Police were responsible for supervising him. After learning about the missing bitcoin, the police launched an investigation, and evidence began pointing to Chowles.

“He took advantage of his position working on this investigation by lining his own pockets while devising a plan that he believed would ensure that suspicion would never fall upon him,” said Alex Johnson, Specialist Prosecutor with the CPS’s Special Crime Division.

Police arrested Chowles in May 2022 and recovered an iPhone, which linked Chowles to an account used to transfer Bitcoin. Browser search history also revealed the use of crypto exchange services. Several notebooks contained usernames, passwords, and statements relating to White’s crypto accounts.

“Once he had stolen the cryptocurrency, Paul Chowles sought to muddy the waters and cover his tracks by transferring the Bitcoin into mixing services to help hide the trail of money,” Johnson explained.

How was the crypto traced back?

Blockchain analysis firm Chainalysis helped investigators identify and recover part of the stolen bitcoin. Chowles used Bitcoin Fog, a popular mixing service that had long maintained a reputation for sophisticated obfuscation in the crypto underworld.

However, it did not prevent cybercrime officers from tracing the funds through the service.

“Investigators were able to identify that some of the funds were cashed out at exchanges and other services,” Chainalysis said in a report.

Chainalysis also showed the flow of funds in five key stages.

First, Chowles transferred 50 bitcoins from White’s “retirement wallet” to two intermediary wallets. Then the funds were deposited into the Bitcoin Fog mixer.

Later, some of the stolen crypto was withdrawn from Bitcoin Fog directly to a P2P Service deposit address — a temporary wallet used for trading. Instead of regulated exchanges, criminals use P2P services to sell assets directly, blend in with normal users, and avoid detection.

At a later stage, more funds were sent to the P2P service from the withdrawal wallet. Chowles kept almost 30 BTC, sent over four transactions, in a separate wallet, which was later seized by police.

Investigators explain that Chowles converted and spent part of the stolen bitcoins through Cryptopay and Wirex debit cards, making hundreds of transactions between August 2021 and July 2022. He spent over £23,000 via Cryptopay and nearly £80,000 via Wirex, while also withdrawing thousands in converted cash.

The CPS estimates that Chowles gained a total of £613,147.29 through his criminal activities.

“Following the laundering process, Chowles consolidated approximately 30 BTC into what investigators termed the ‘Default Wallet.’ This wallet remained dormant for nearly five years until 2022, when a police search of Chowles’ residence revealed a device containing its private keys.”

The blockchain’s immutable records provided critical evidence to link transactions to the recovered assets, which were subsequently seized by Merseyside Police and valued at over $1.3 million at the time.

At the time of the theft, the value of 50 bitcoins was around £60,000, while its current estimated value is over £4.4 million.

“We know criminals have sought to use cryptocurrency as a way to launder money from illegal activities, including drug dealing and fraud. It will be extremely disappointing to everyone that someone involved in law enforcement could involve themselves in the very criminality they are tasked with investigating and preventing,” said Detective Chief Inspector John Black, from Merseyside Police's Force Intelligence Bureau.

The CPS said it will now pursue confiscation proceedings to recover the money made from the crime.

⚖️ Ex-National Crime Agency officer Paul Chowles, 42, has been jailed after he stole 50 Bitcoin – now worth around £4.4m – which had been seized during a criminal investigation.

We worked with @MerseyPolice to secure these convictions.

Read more👉 https://t.co/HNUUQAAT2Z pic.twitter.com/2yIsyJgHFv

undefined Crown Prosecution Service (@CPSUK) July 16, 2025

On Wednesday at Liverpool Crown Court, Chowles was jailed for a total of five and a half years after pleading guilty to theft (30 months), transferring criminal property (12 months, served concurrently), and concealing criminal property (36 months, served consecutively).

He was dismissed from the NCA on 11th July 2025.