← Back to Index

NCA / Law Enforcement Corruption / Cryptocurrency

NCA Corruption: Paul Chowles and the 50 Bitcoin Theft

A former National Crime Agency officer stole 50 Bitcoin from a criminal's seized wallet — then laundered it over five years. He was never caught by the NCA. He was caught by Merseyside Police, running an entirely separate investigation. The institution whose officer committed the crime played no role in exposing it.

Convicted NCA Insider Theft Blockchain Forensics
✓ Primary source: Crown Prosecution Service — cps.gov.uk — Ex-NCA officer jailed for theft of 50 Bitcoin (2025)

The Subject

Paul Chowles
Former Operational Officer, National Crime Agency — Date of Birth: 30 August 1982 — Bristol
Convicted Of Theft; Transferring Criminal Property; Concealing Criminal Property
Sentence 5 years 6 months — Liverpool Crown Court, 16 July 2025
Bitcoin Stolen 50 BTC (of 97 BTC seized from Thomas White)
Value at Time of Theft ~£59,409
Value at Sentencing £4.4 million
NCA Dismissed 11 July 2025
Caught By Merseyside Police — not the NCA
50
Bitcoin stolen from seized criminal wallet
£4.4M
What that Bitcoin is worth today
279+
Transactions used to launder proceeds
5yrs
He laundered the money before detection
0
NCA internal systems that flagged it

Background — The Original Investigation

Paul Chowles was an operational officer with the National Crime Agency, involved in a joint NCA/FBI operation targeting the Silk Road dark web marketplace. The investigation eventually led to the prosecution of Thomas White, who operated Silk Road 2.0 — a successor to the original Silk Road after it was shut down by the FBI in 2013.

White was convicted in April 2019 and sentenced to 64 months in prison. As part of the investigation, 97 Bitcoin were seized from White's criminal holdings and became the property of the Crown — securely held, or so it was supposed to be, under NCA custody.

Silk Road Context
Silk Road was a dark web marketplace that facilitated the sale of drugs, counterfeit documents, and other illegal goods using Bitcoin as currency. Its seizure by the FBI in 2013 — and the later prosecution of Silk Road 2.0 operators — involved hundreds of millions of dollars in Bitcoin. These investigations gave law enforcement officers access to some of the largest cryptocurrency holdings ever seized. That access created both opportunity and temptation.

What Chowles Did

Between May 2017 and 2022, Chowles exploited his access to the seized wallet to transfer 50 of the 97 Bitcoin into accounts he controlled. He did not take the full amount — likely to avoid making the discrepancy immediately obvious. He left 47 Bitcoin untouched, taking slightly more than half.

He then systematically laundered the proceeds over five years using a layered approach:

His calculated benefit was assessed by prosecutors at £613,147.29. At today's Bitcoin price, the 50 coins are worth approximately £4.4 million.

How He Was Caught — and Who Caught Him

This is the critical question — and the answer is damning for the NCA as an institution.

The NCA did not catch Paul Chowles. Merseyside Police did.

The chain of events that led to his exposure began not with any NCA internal audit, not with any professional standards referral, and not with any financial monitoring flag. It began with the man he had stolen from.

Thomas White, serving his prison sentence, raised the alarm. He recognised that whoever had taken the Bitcoin must have had access to the private keys of his wallet — access that only someone inside the NCA investigation could have had. He made this known. Merseyside Police — a regional force with no connection to the original NCA dark web investigation — picked up the thread and launched their own inquiry in 2022.

It was Merseyside Police who recovered Chowles' iPhone, found links to the cryptocurrency accounts, uncovered his browser history relating to cryptocurrency activity, and discovered the notebooks containing wallet credentials. The NCA's own oversight apparatus had produced nothing in the years between the first theft in 2017 and the Merseyside Police investigation in 2022.

The Institutional Exposure
Five years. That is how long Paul Chowles stole from a seized criminal wallet, laundered the proceeds through hundreds of transactions, and continued working as an NCA operational officer — while the NCA's internal systems, supervisory structures, financial monitoring, and professional standards processes identified nothing. It took a convicted criminal raising the alarm, and a separate police force entirely unconnected to the original investigation, to do what the NCA could not — or did not — do itself.

The NCA's Detection Failure — What Should Have Caught This

Every Layer That Should Have Flagged This — Did Not

✗
Asset reconciliation: Seized cryptocurrency should be reconciled against case records periodically. 50 of 97 seized Bitcoin disappearing — leaving the wallet approximately half-empty compared to documented holdings — was not detected through any NCA asset management process.
✗
Blockchain monitoring: The NCA is a sophisticated agency with access to blockchain analytics tools. The movement of 50 Bitcoin from a wallet under NCA custody, processed through a known mixing service (Bitcoin Fog), was apparently not monitored against NCA-held wallet addresses.
✗
Financial intelligence: 279 transactions converting cryptocurrency to cash through debit cards, totalling over £109,000, over five years — made by a mid-ranking NCA officer — produced no suspicious activity report, no lifestyle flag, and no professional standards inquiry.
✗
Wallet access auditing: Access to seized cryptocurrency private keys should be logged, attributed, and reviewed. If such logs existed, they were not used to detect the unauthorised transfer Chowles made.
✗
Post-conviction review: Following Thomas White's conviction in 2019, a standard review of the seized assets associated with his case — checking that they remained intact — apparently did not occur, or did not detect the missing Bitcoin.

Timeline

2013
FBI shuts down Silk Road 1 — NCA/FBI joint operation begins targeting Silk Road 2.0
Thomas White operating Silk Road 2.0. Joint investigation underway. Chowles is an NCA operational officer involved in the investigation.
MAY 2017
First alleged theft — 50 BTC transferred out of Thomas White's seized wallet
Chowles uses his access to the wallet's private keys to transfer 50 of 97 seized Bitcoin into accounts he controls. At the time, the 50 BTC is worth approximately £59,409. No NCA system flags the transfer.
2017–2022
Five years of laundering — 279+ transactions, £109,000+ extracted
Chowles routes the stolen Bitcoin through the Bitcoin Fog mixing service, then converts proceeds via Cryptopay and Wirex debit cards. Hundreds of transactions. No internal NCA flag during this entire period.
APRIL 2019
Thomas White convicted — sentenced to 64 months
White goes to prison. Post-conviction review of seized assets apparently fails to detect that 50 of 97 Bitcoin are missing. Chowles continues laundering.
2022
Thomas White raises the alarm from prison — Merseyside Police investigate
White recognises that access to his wallet's private keys could only have come from inside the NCA. He flags this. Merseyside Police — not the NCA, not HMICFRS, not IOPC — launch an independent investigation. This is the first institutional response to five years of theft.
2022–2025
Merseyside Police build the case — phone, notebooks, browser history
Investigators recover Chowles' iPhone with cryptocurrency account links, browser history relating to crypto activity, and notebooks containing wallet credentials. Blockchain analysis maps the full trail from the seized wallet through Bitcoin Fog to the debit cards.
11 JULY 2025
Chowles dismissed from the NCA
Five years, two months, and eleven days after the first theft. Dismissed only days before sentencing.
16 JULY 2025
Sentenced to 5 years 6 months — Liverpool Crown Court
Convicted of theft, transferring criminal property, and concealing criminal property. The 50 Bitcoin he stole is now worth £4.4 million.

The Sentence

Liverpool Crown Court — 16 July 2025

Theft of 50 Bitcoin 30 months
Transferring criminal property 12 months concurrent
Concealing criminal property (5 years of laundering) 3 years consecutive
Total 5 years 6 months

The Central Question: Cover-Up, Negligence, or Structural Blindness?

The NCA did not catch Paul Chowles. That is a fact. The question worth asking — and which the institution has not publicly answered — is why.

Could the NCA Have Covered This Up?

The possibility cannot be dismissed on the facts available. Chowles was an operational officer with colleagues, supervisors, and access to case files. The discrepancy in the seized Bitcoin holdings was — at minimum — detectable through any standard reconciliation of on-chain balances against case records. The question of whether anyone at the NCA noticed and said nothing, or whether the institution's culture of protecting operational integrity extended to not looking too closely at what its own officers were doing with seized assets, has not been publicly examined.

There is a version of events in which the NCA's failure to detect Chowles was pure institutional negligence — no one thought to look. There is another version in which the failure was not entirely accidental. Without an independent inquiry into NCA asset handling processes and what supervisors knew and when, both possibilities remain open. The NCA has a vested institutional interest in the answer being negligence rather than concealment. That is precisely why the answer should not be left to the NCA to provide.

What is not in dispute: a convicted criminal raising the alarm from his prison cell, and a regional police force with no stake in the outcome, produced a result that five years of NCA internal operations did not. That asymmetry demands explanation — not from Merseyside Police, who did their job, but from the institution whose officer spent half a decade stealing from it.

The Structural Problem Bitcoin Fog Exploited

Chowles used Bitcoin Fog — a mixing service — specifically to break the blockchain trail. Mixing services are well-known to law enforcement; the NCA's own cryptocurrency investigators use blockchain analytics tools to trace funds through mixers in criminal cases every day. The irony is precise: the same analytical capability the NCA deploys against criminals was not deployed against its own officer's transactions, despite those transactions flowing through a known mixer from a wallet under NCA custody.

If the NCA had pointed its own tools at its own seized wallets — monitoring outflows against case records — Chowles would have been identifiable far earlier. The decision not to do that, or the absence of any system that did it automatically, is the institutional failure at the heart of this case.

"The irony of an NCA officer using the same techniques — mixers, fragmented transactions, debit card cashouts — that the NCA teaches its investigators to look for, and not being identified by those investigators for five years, tells you everything about where the gaze of law enforcement oversight is pointed. Outward. Never inward."

Sources