How did the police officer become a thief?
In a significant breach of trust within UK law enforcement, Paul Chawls, an officer of the National Crime Agency (NCA), embezzled 50 Bitcoin (BTC) from a seized wallet associated with Thomas White, the operator of Silk Road 2.0.
The theft took place in 2017 when the value of the cryptocurrency was around £60,000 (about $79,000). By the time Chawls was caught, that sum had ballooned to over £4.4 million (about $5.9 million). The 42-year-old from Bristol utilized dark web services and crypto mixing to fragment the stolen Bitcoin into smaller sums, transferring it through crypto exchanges and prepaid cards in an attempt to obscure its origins.
Initially, investigators thought that White might have reclaimed access to his funds while incarcerated. However, thorough blockchain analysis eventually pointed to Chawls as the culprit. His arrest and subsequent five and a half-year sentence demonstrated that blockchain technology can expose wrongdoing—even among insiders—and that no one is above the law.
Background: Silk Road 2.0, Thomas White, NCA
Back in 2013, the FBI shut down an illegal online marketplace known as the Silk Road, which facilitated the trade of illegal drugs and various goods on the dark web. Shortly after that, Thomas White, a British national, launched Silk Road 2.0, which quickly gained traction.
That successor site was also taken down in 2014 due to a collaborative effort by UK authorities and the FBI. During this crackdown, authorities confiscated 97 BTC from White, which was set aside as part of his sentencing.
Paul Chawls, functioning as NCA’s lead crypto analyst, had the responsibility of managing White’s cryptocurrency. His expertise was vital for tracking and safeguarding these digital assets for law enforcement.
Chawls’ involvement in White’s investigation gave him a unique opportunity to access and commit one of the most significant internal thefts within the NCA.
Did you know? In 2021, U.S. authorities seized over 94,000 BTC tied to the 2016 Bitfinex hack, valued at more than $3.6 billion at that time, marking a major financial incident in U.S. history.
How did Chawls commit theft of the code?
Chawls committed the theft between May 6 and 7, 2017, which ultimately led to his dismissal and imprisonment.
Initially, investigators suspected that White, being a skilled hacker, might have regained access to his seized assets while incarcerated. For a long time, the theft remained a mystery, leading the NCA to believe by mid-2021 that they might never track down the 50 BTC. Chawls’ elaborate ruse seemed to work until blockchain analysis eventually uncovered his fraudulent actions.
After stealing the Bitcoin, Chawls quietly sought ways to convert it into cash. With Bitcoin’s value surging from August 2021 to May 2022, he began trading some of it through platforms like Cryptopay and Wirex.
These platforms enabled Chawls to exchange BTC for British pounds, which he accessed via a debit card linked to his account. During this time, he conducted 279 transactions, spending around £23,000 from August 26 to May 20, 2021. Additionally, he made five separate withdrawals totaling £6,232 between August 30, 2021, and February 22, 2022.
Overall, from late August 2021 to mid-July 2021, Chawls spent approximately £79,884.77 using his Wirex account and debit card (equivalent to roughly $107,438.62). The CPS estimated his total illicit gains at around £613,147.29 (valued at approximately $824,634.05).
Chawls’ use of mainstream financial platforms, paired with deliberate attempts to mask his transactions, seems to reflect his belief that he could sidestep detection. Nevertheless, the volume and nature of his spending ultimately provided investigators crucial leads to track the stolen funds.
Did you know? Governments have often seized Bitcoin linked to criminal activities. Since 2014, various entities have sold tens of thousands of BTC, with some being acquired by early investors, transforming government recovery efforts into lucrative opportunities for them.
Research and elucidation of Chowles’ scheme
In early 2022, following his release, White pointed out that access to the private key of his confiscated Bitcoin wallet was exclusive to NCA insiders, prompting an investigation by Merseyside police into Chawls.
Investigators uncovered qualifications, browser history, and wallet information that tied him directly to the 2017 theft of 50 BTC, using blockchain analysis to trace the funds through various exchanges despite Chawls’ attempts to conceal them.
The combination of digital forensics and blockchain analysis illuminated his scheme. After nearly three years of legal proceedings, Chawls pleaded guilty to theft in March 2025 for transferring and concealing stolen property. This incident exposed serious issues regarding insider misconduct in law enforcement, given his position as a trusted NCA crypto analyst.
In July 2025, Liverpool Crown Court sentenced him. On July 11, 2025, the NCA dismissed Chawls for gross misconduct. The ruling served both as punishment and as a reminder that even trusted law enforcement officials face severe consequences when they violate public trust.
CPS specialist prosecutor Alex Johnson stated that Chawls was “taking advantage of his position” to benefit himself during the investigation, orchestrating a plan to ensure he remained undetected.
Detective John Black expressed the unfortunate reality that it is regrettable to witness anyone involved in law enforcement committing such crimes.
Aftermath and assets recovery from Chawls
Post-conviction, authorities sought to recover the stolen cryptocurrency. They managed to seize about £470,000 from Chawls’ accounts and assets, equating to 30 BTC at current values.
The CPS has initiated ongoing forfeiture proceedings to reclaim the remaining illicit gains. Additionally, the NCA dealt with assets connected to Silk Road 2.0 operator Thomas White. From the initial seizure of 97 BTC, 47 BTC remained, which have been sold under court orders by the NCA, bringing in roughly £1 million.
This recovery highlights an improved capability to track, seize, and convert digital assets, ensuring that neither criminals nor corrupt insiders can evade accountability.
Did you know? Cryptocurrency investigations often necessitate international collaboration. Organizations like Europol, Interpol, and the FBI share blockchain intelligence to recover illicit funds. Such joint efforts have led to effective crackdowns on darknet markets, including Hydra.
Important Lessons from Chowles’ Crypto Theft
The case of Paul Chowles serves as a stark reminder that even those within law enforcement can exploit the very assets they are meant to protect. However, it also underscores how the transparency of blockchain technology and advanced investigative tools can uncover concealed crimes, even years later.
Key takeaways from the Chowles case and their broader implications include:
- Blockchain Traceability: Despite Chawls’ efforts to hide the theft through Bitcoin Fog, Chain Orisis successfully tracked nearly five years of stolen funds, proving the effectiveness of blockchain analysis.
- Insider Risk: Access to Chawls’ private keys and forensic tools highlights the vulnerabilities of trusted personnel, calling for stricter internal safeguards.
- Legal and regulatory impacts: This case emphasizes the urgent need for enhanced protocols for managing cryptocurrency assets, which can lead to more effective seizure and recovery processes, as well as improved oversight within law enforcement.
