Former NCA Officer Ordered to Repay £1.8m After Stealing Bitcoin Seized in Dark Web Investigation

A former investigator with the National Crime Agency has been ordered to hand back Bitcoin currently valued at approximately £1.8 million after he admitted stealing the cryptocurrency from a wallet he had helped seize during a major criminal probe.

Paul Chowles, 44, of Bristol, was previously sentenced to five and a half years in prison at Liverpool Crown Court after entering guilty pleas to charges of theft and money laundering. The confiscation order, secured by the Crown Prosecution Service, requires him to repay a sum matching the value of the 30 Bitcoin recovered from him — a hoard that was worth only around £36,000 at the time of the offence but has since surged in value to more than £1.8 million.

The case centres on Chowles's role in an NCA investigation into criminals who were using the dark web to trade illegal goods. As part of that operation, he participated in the analysis and extraction of cryptocurrency from digital devices that had been seized. That work ultimately contributed to the prosecution of Thomas White, who was jailed for 64 months in 2019 after being found to have sold illegal goods to criminal networks on Silk Road 2.0, an underground marketplace.

During the investigation, 97 Bitcoin were seized from White. It later became apparent that 50 Bitcoin had been withdrawn from the digital wallet. The NCA initially suspected that White himself had somehow managed to access the wallet while in custody, but he consistently denied any involvement in the missing funds.

The truth, however, was very different. It was Chowles who removed the Bitcoin from the confiscated wallet in 2017, before attempting to conceal his actions through a complex series of cryptocurrency transactions designed to obscure the trail. The deception allowed suspicion to fall on the very criminal the agency had been investigating.

An investigation into the stolen Bitcoin was subsequently launched by Merseyside Police. Chowles was arrested in May 2022, and a total of 30 Bitcoin was recovered from him. The remaining shortfall reflects the fact that not all of the misappropriated funds could be traced or retrieved.

Luke Clements, of the CPS proceeds of crime division, said the former NCA officer had "exploited a position of trust for personal gain." He emphasised that confiscation orders remain a powerful mechanism for ensuring that crime does not pay, adding that the order sends a clear message that authorities will pursue offenders' assets relentlessly and seek to recover criminal proceeds wherever they may be hidden.

The CPS confirmed that the confiscation order was secured earlier and is equal to the value of the 30 Bitcoin recovered from Chowles. Because the order is valued against the cryptocurrency's present worth rather than its price at the time of the theft, Chowles now faces a far heavier financial penalty than the original sum he took. The dramatic appreciation in Bitcoin's value means he must repay roughly fifty times what the stolen coins were worth when he moved them.

The case highlights the particular difficulties that cryptocurrency poses for law enforcement, even for the agencies tasked with seizing it. Digital assets can be moved across borders in seconds, split across numerous wallets and passed through mixing services in an effort to defeat forensic analysis. When the person handling those assets is an insider with technical expertise, the challenge becomes even more acute.

The fact that Chowles was part of the very team responsible for extracting cryptocurrency from seized devices underlines the level of trust placed in him and the seriousness of the breach. His actions not only deprived the public purse of assets that should have been realised through the proceeds of crime regime, but also risked undermining the prosecution of Thomas White by creating the false impression that White had continued to control his wallet from prison.

Chowles's sentence and the subsequent confiscation order together represent a two-pronged response: punishment through imprisonment and financial recovery through the courts. The confiscation order is a civil mechanism that operates alongside criminal sentencing, allowing authorities to claw back the value of criminal gains even after a defendant has been convicted. Failure to satisfy such an order can result in further imprisonment.

The NCA has not commented publicly beyond the details already released, but the case is likely to prompt fresh scrutiny of internal controls surrounding the handling of seized cryptocurrency. Agencies across the UK have been building up their capacity to store and manage digital assets, and the Chowles affair demonstrates the importance of robust oversight, separation of duties and audit trails when dealing with funds that can be transferred irreversibly at the click of a button.

For the CPS, the outcome is being presented as a demonstration of the proceeds of crime legislation's reach. Confiscation orders are designed to ensure that offenders do not benefit from their crimes once they have served their sentences, and they can be applied to a wide range of assets, including cryptocurrency. The order against Chowles means that, in principle, the public purse will recover a sum equivalent to the current market value of the Bitcoin he stole, rather than the much smaller amount it was worth at the time.

The case also serves as a cautionary tale about the volatility of cryptocurrency valuations. Had Bitcoin's price fallen rather than risen, the confiscation order would have been worth correspondingly less. As it stands, the appreciation has worked in the authorities' favour, turning a theft originally valued in the tens of thousands of pounds into a multimillion-pound recovery.

Chowles, who is from Bristol, was jailed last year. The confiscation order was secured separately and has now been confirmed. The CPS has indicated that it will continue to pursue offenders' assets wherever they are concealed, whether in traditional bank accounts, property or digital wallets.

The investigation was carried out by Merseyside Police, which arrested Chowles in May 2022 following the discovery that Bitcoin was missing from the seized wallet. The recovery of 30 Bitcoin from him provided the basis for the confiscation order now in place. The case remains one of the more striking examples of an insider abusing their access to seized criminal assets, and it is likely to shape how law enforcement agencies approach the storage and management of cryptocurrency in future operations.