Former NCA Officer Ordered to Repay £1.8m After Stealing Seized Bitcoin

A former investigator with the National Crime Agency has been ordered to hand back more than £1.8 million after he admitted stealing Bitcoin that he himself had helped seize during a major criminal investigation. Paul Chowles, 44, from Bristol, was told he must repay the sum, which represents the surging value of the cryptocurrency he illegally transferred into his own accounts nearly a decade ago.

The confiscation order was secured by the Crown Prosecution Service under proceeds of crime legislation, which allows authorities to recover the financial value of criminal gains rather than the specific assets involved. Because the price of Bitcoin has risen dramatically since the theft, the amount Chowles now owes has ballooned far beyond what he originally took, rising from roughly £36,000 to over £1.8 million.

Chowles had already been sentenced to five and a half years in prison at Liverpool Crown Court last year after pleading guilty to theft and money laundering. His downfall followed a lengthy investigation into how cryptocurrency seized during an NCA probe had mysteriously vanished from a digital wallet that was supposed to be under official control.

The original NCA case concerned Thomas White, who was jailed for 64 months in 2019 after being found to have sold illegal goods to criminal networks on the dark web marketplace Silk Road 2.0. As part of that operation, investigators seized 97 Bitcoin from White. At the time, the cryptocurrency was still relatively niche, and few could have predicted the enormous escalation in its market value that would follow.

It was during the handling of that seizure that problems emerged. Officials noticed that 50 Bitcoin had been withdrawn from the digital wallet holding White's confiscated assets. The NCA initially assumed that White had somehow managed to access the wallet from custody, but he consistently denied any involvement. For a period, the disappearance remained unexplained, and suspicion fell on the convicted criminal rather than on the officers entrusted with the case.

In reality, it was Chowles who had taken the Bitcoin back in 2017. As a member of the team working on the investigation, he had been directly involved in analysing and extracting cryptocurrency from digital devices seized during the operation. That role gave him both the technical knowledge and the access needed to move funds out of the confiscated wallet, and he then attempted to conceal his actions through a series of cryptocurrency transactions designed to obscure the trail.

The theft was eventually uncovered through a separate investigation led by Merseyside Police into the missing Bitcoin. Chowles was arrested in May 2022, and a total of 30 Bitcoin was recovered from him. Although this was fewer than the 50 Bitcoin that had been withdrawn, the confiscation order was calculated to match the value of the 30 coins recovered, which has since appreciated enormously.

Luke Clements, of the CPS proceeds of crime division, said the former NCA officer had exploited a position of trust for personal gain. He described confiscation orders as a powerful tool for ensuring that crime does not pay, and said the order sent a clear message that offenders' assets would be pursued relentlessly and that criminal proceeds would be recovered wherever they were hidden.

The case highlights the particular challenges that cryptocurrency poses for law enforcement, even for the agencies responsible for investigating serious and organised crime. Digital assets can be moved across borders almost instantly and, in the early years of Bitcoin's existence, were often treated as an obscure technical curiosity rather than a valuable commodity. That combination created opportunities for insider theft that traditional safeguards were not always designed to detect.

It also illustrates how the passage of time can transform the scale of a financial crime. When Chowles moved the Bitcoin in 2017, his actions may have appeared to involve a relatively modest sum. Years later, the same coins are worth many times more, turning what might have been a smaller repayment into a seven-figure confiscation order that will follow him long after his prison sentence ends.

The involvement of Merseyside Police, rather than the NCA itself, reflects the seriousness with which such allegations are treated when they involve the very officers tasked with upholding the law. Independent scrutiny is essential in maintaining public confidence, particularly when the credibility of an agency's evidence handling could be called into question during future prosecutions.

For the CPS, the outcome demonstrates the value of proceeds of crime legislation in cases where the underlying assets are volatile and difficult to value. By securing an order equal to the current worth of the recovered Bitcoin, prosecutors have ensured that Chowles cannot benefit from the appreciation of assets he obtained unlawfully. The message is that the financial consequences of such offending are calculated at the point of enforcement, not at the point of theft.

The case also serves as a warning to anyone working with seized digital assets. As cryptocurrency becomes more embedded in criminal investigations, the systems for storing, auditing and transferring seized coins will face increasing scrutiny. The theft of Bitcoin from an official wallet is precisely the kind of incident that prompts reviews of internal controls, access permissions and oversight.

Chowles, who had pleaded guilty to both theft and money laundering, now faces the prospect of repaying a sum far greater than anything he might have anticipated when he moved the coins. His sentence is already being served, but the confiscation order ensures that the financial reckoning continues, and that the public purse can recover the value of what was taken.

The Crown Prosecution Service said it would continue to pursue offenders' assets wherever they are hidden, and the case stands as an unusually stark example of that commitment. It also leaves a troubling question for the NCA: how a trusted insider was able to remove evidence from a live investigation, and how long it took for the truth to emerge. The answers may shape how the agency handles digital evidence in the years ahead.