犯罪

Chainalysis 、NCA職員による押収ビットコインの横領事件の解明にどのようにChainalysis

要約

  • A UK law enforcement officer stole approximately 50 BTC from assets seized in the Silk Road 2.0 investigation.
  • Despite using the Bitcoin Fog mixing service, the suspect’s transaction trail was traced using Chainalysis’ industry-leading data and expert investigation services.
  • After a five-year dormancy period, authorities recovered $1.3 million worth of the stolen bitcoin.
  • This case demonstrates how blockchain’s permanent record, combined with advanced analytics, can expose sophisticated financial crimes.

 

In 2019, UK authorities achieved a significant victory against darknet markets with the arrest of Thomas White, administrator of Silk Road 2.0. During the operation, authorities seized White’s devices, but what appeared to be a straightforward investigation would later reveal a shocking betrayal: a National Crime Agency (NCA) officer discovered private keys on the seized devices and used them to steal nearly 50 bitcoin from White’s wallet.

In 2017, during the active investigation, investigators identified an unauthorized transfer of approximately 50 BTC from White’s suspected wallet. The movement, though initially undetected, left an indelible mark on the blockchain. The funds held in the wallet were sent over a series of transactions to a popular mixing service, Bitcoin Fog, before being systematically withdrawn in a pattern clearly designed to avoid detection.

Unraveling the scheme: Investigation and evidence

In 2022, Merseyside Police initiated an investigation into White’s missing 50 BTC. Bitcoin Fog had long maintained a reputation for sophisticated obfuscation in the crypto underworld, but this didn’t prevent specialist cybercrime officers from tracing the funds through the service.

As the investigation progressed, evidence began pointing not to White, but rather to one of the NCA officers involved in the initial 2017 investigation. Utilizing Chainalysis software and services, investigators were able to identify that some of the funds were cashed out at exchanges and other services. This provided opportunities for Merseyside Police detectives  to secure evidence in the form of identification documents, indicating that Chowles, the NCA officer who had been part of the original investigation team, was in fact behind the transactions.

Screenshot from Chainalysis’s blockchain visualization tool, Reactor, showing the flow of funds through five key stages

From detection to recovery: Bringing justice

Following the laundering process, Chowles consolidated approximately 30 BTC into what investigators termed the “Default Wallet.” This wallet remained dormant for nearly five years until 2022, when a police search of Chowles’ residence revealed a device containing its private keys.

After Chowles’s arrest, Chainalysis Global Services provided crucial expert evidence documenting the complete flow of funds, which proved instrumental in securing a guilty plea from the former NCA officer. The blockchain’s immutable record, combined with Chainalysis’s world-leading data and expert analysis, provided critical evidence to link transactions to the recovered assets, which were subsequently seized by Merseyside Police and valued at over $1.3 million at the time.

The case highlighted three fundamental principles of modern financial investigation: the permanence of blockchain records ensuring evidence remains accessible regardless of time passed; the ability of advanced analytics to overcome sophisticated attempts at fund obfuscation; and cryptocurrency’s inherent transparency in exposing insider threats, as every transaction leaves an indelible digital footprint. Crucially, this case also demonstrates the vital importance of skilled investigators; without the expertise of Merseyside Police’s trained cybercrime officers, these transactions might have remained buried in the blockchain’s vast ledger.

The blockchain never forgets

Blockchain records remain permanent and transparent; however, these records are only as valuable as an investigator’s ability to interpret them. The combination of immutable transaction records, Chainalysis’s sophisticated analytical capabilities, and well-trained law enforcement officers transforms cryptocurrency from a perceived tool of obscurity into investigative opportunity.

Years after the initial theft, the blockchain revealed the truth, and through the combined efforts of skilled investigators and Chainalysis’s tools and services, that truth was surfaced, proving that in the world of cryptocurrency, every action leaves a lasting trace, waiting to be discovered by those with the expertise to find it.

本ウェブサイトには、Chainalysis, Inc. およびその関連会社(以下、総称して「Chainalysis」)の管理下にない第三者のサイトへのリンクが含まれています。当該情報へのアクセスは、Chainalysis が当該サイトまたはその運営者との提携、支持、承認、または推奨を行っていることを意味するものではなく、Chainalysis は、当該サイトで提供される製品、サービス、その他のコンテンツについて一切の責任を負いません。 

本資料は情報提供のみを目的としており、法律、税務、財務、または投資に関する助言を提供するものではありません。受領者は、こうした決定を行う前に、各自のアドバイザーに相談してください。Chainalysis は、受領者が本資料を利用したことに起因する、つながり におけるいかなる決定、その他の作為または不作為についても、一切の責任を負いません。

Chainalysis 当社は、本報告書に記載された情報の正確性、完全性、適時性、適合性、または有効性を保証するものではなく、当該資料のいかなる部分における誤り、欠落、またはその他の不正確さに起因するいかなる請求についても責任を負いません。