Ex-NCA officer ordered to repay GBP 1.8 million for stolen Silk Road bitcoins
On 30 September 2026, it was announced that Paul Chowles, a former National Crime Agency officer from Bristol, has been ordered to pay GBP 1,810,678.93 under the Proceeds of Crime Act. The order closes, in financial terms, one of the more uncomfortable recent chapters of UK law enforcement: an investigator stealing part of a cryptocurrency seizure connected to a case he worked on. Chowles had already been jailed for five and a half years at Liverpool Crown Court after admitting theft and money laundering. The 50 bitcoins he took were worth about GBP 60,000 when they were stolen in 2017. By sentencing, they were worth around GBP 4.4 million.
The theft inside a seizure
The coins came from Thomas White, the admin of darknet market Silk Road 2.0. In 2017, investigators seized 97 bitcoins from White, and Chowles took 50 of them for himself, moving the coins and concealing what he had done. The theft surfaced years later, once bitcoin's price had turned the stash into a sum worth pursuing across borders. According to the Crown Prosecution Service, only 30 of the 50 stolen bitcoins were recovered. A confiscation order under the Proceeds of Crime Act fixes the amount an offender must repay even where the remaining assets can no longer be traced, which is how a shortfall of 20 coins becomes a debt. The sequence of events was reported by the BBC when the confiscation order was announced, and the CPS statement covers the original prosecution. The Register adds a detail that is easy to overlook: White himself was separately ordered to pay GBP 1,560,506, the proceeds of his own darknet activity. The same legislation is therefore working on both sides of the case, recovering the market administrator's gains while also recovering what a police employee took from the evidence chain.Only 30 of the 50 bitcoins Paul Chowles stole from a 2017 NCA seizure were recovered, according to the Crown Prosecution Service.
What happens to seized crypto
Cryptocurrency is only seized in a loose sense. The coins stay on the blockchain; what an agency actually holds are the private keys, usually wallet files or seed phrases stored in evidence systems. From there, seized crypto behaves like any other high-value asset in custody, with one exception: its market price moves whether or not anyone touches it. The 2017 seizure was a routine piece of a darknet investigation, and the GBP 60,000 of bitcoin it captured grew to around GBP 4.4 million over the following years on its own. That gap between seizure value and realisation value shapes everything in crypto enforcement, from how hard agencies pursue small seizures to how confiscated coins are eventually disposed of. For that disposal side, we have previously looked at how governments sell seized bitcoins.Insider risk in the seizure chain
The uncomfortable lesson of the case is structural. A seizure chain concentrates value and trust in a small group of people, and if one of them copies the keys, nothing on the blockchain records a theft: a movement made with a valid private key is indistinguishable from any other transaction. Detection has to come from the off-chain side, from custody audits, access logs and someone eventually noticing that a wallet does not behave as its documentation says it should. In this case that took years, and the scale of the loss only became apparent once the price of bitcoin had risen enough to make the missing coins worth a fortune. Coverage in German at Tarnkappe makes the same point from another angle: the state is recovering stolen seizure property from its own former officer, which is about as direct a demonstration of insider risk as this sector has produced. Nothing in the verified reporting suggests the NCA's procedures were unusually weak. A single officer with legitimate access is simply enough to defeat many controls, which is why serious custody design starts from the assumption that someone will try, not that nobody will.Evidence custody needs the same opsec
Darknet enforcement gets judged on its operational side: honeypots, server images, chain analysis, the drama of a takedown. The Chowles case points at the quieter half. Seized material sits in storage for years while cases grind through the courts, and the same operational security logic that protects a live investigation has to apply to that storage: strict key custody, split knowledge so no one person holds a whole wallet, independent verification that the coins still sit where the records say, and monitoring of the wallets themselves. A seizure that cannot be defended against the agency's own staff is not, in any meaningful sense, under control. For reference, the key numbers of the case as reported:- 97 bitcoins seized from Thomas White, admin of Silk Road 2.0, in 2017
- 50 of them stolen by Paul Chowles, worth about GBP 60,000 at the time
- Five and a half years' imprisonment at Liverpool Crown Court for theft and money laundering
- GBP 1,810,678.93 confiscation order, announced on 30 September 2026
- 30 of the 50 stolen bitcoins recovered
- GBP 1,560,506 confiscation order against White himself