Ex-FBI Agent Indicted for Siphoning $2.2M in Seized Bitcoin and Ether

TL;DR An unsealed federal indictment accuses a former cyber task force investigator of copying seed phrases during darknet seizures to quietly drain $2.2 million from crime victims and government holding wallets.

Federal prosecutors unsealed an indictment this morning charging a former FBI cyber task force agent with wire fraud, money laundering, and obstruction of justice after an internal audit revealed more than $2.2 million in digital assets had vanished from government-controlled custody.

The defendant, 41-year-old Marcus Vance, served in the bureau’s San Francisco field office until his quiet resignation in late 2025. According to court filings made public on Thursday in the U.S. District Court for the Northern District of California, Vance systematically copied private keys and seed phrases found on seized paper notes and unencrypted flash drives during raids, waiting months before draining the wallets into mixer-bound addresses. The victim funds included restitution pools earmarked for individuals defrauded in investment scams as well as corporate funds recovered from ransomware crackdowns.

federal court building exterior columns — Photo by Tim Mossholder on Unsplash

Exploiting the Evidence Gap

The court filing details an operation that relied on basic procedural blind spots rather than sophisticated zero-day exploits. Vance served as the primary evidence custodian on several high-profile illicit finance busts between 2023 and 2025. When seizing physical hardware ledgers or written backup sheets, Vance allegedly photographed the seed phrases on personal devices prior to logging the physical items into the bureau’s formal evidence tracking system.

Because on-chain assets do not physically sit inside an evidence bag, investigators monitoring the crypto ecosystem often assume that logging the hardware device secures the underlying value. Vance allegedly capitalized on the operational lag between physical seizure and the transfer of tokens into cold, multi-signature storage managed by the U.S. Marshals Service.

Case / Seizure Origin	Assets Diverted	Method of Diversion	Laundering Route
2023 Darknet Market Bust	18.4 BTC	Seed phrase retained from paper notes	Railgun privacy pool to centralized exchange
2024 Ransomware Payoff Recovery	320 ETH	Unencrypted recovery JSON on seized laptop	Cross-chain bridge to Monero (XMR)
2024 Wire Fraud Restitution Pool	450,000 USDT	Pre-custodial address substitution	Automated peer-to-peer swap services

The scheme began unraveling when forensic accountants preparing restitution distributions for a 2024 investment syndicate noticed that an address holding 320 Ether showed outbound transactions executed months after the suspect was already in custody. Subsequent chain analysis commissioned by the U.S. Department of Justice traced the funds across decentralized liquidity pools, eventually matching transaction timestamps with Vance’s personal IP addresses and accounts tied to offshore sportsbooks.

hardware cryptocurrency wallet usb device on desk — Photo by Simon on Pexels

Broken Custody and Institutional Pushback

The indictment arrives amid heightened scrutiny over how law enforcement secures digital property. While federal agencies have spent years mastering on-chain tracing to track adversaries, their internal controls over the physical access keys securing those balances have lagged behind.

Modern incident response demands stringent cybersecurity baselines, yet federal evidence lockers still routinely process seed phrases on standard paper forms alongside conventional narcotics and contraband. A 2024 review by the Office of the Inspector General warned that field offices lacked standardized multi-party signing protocols at the moment of initial seizure, creating single-point-of-failure vulnerabilities for corrupt insiders.

The theft also directly impacted individual crime victims. More than $600,000 of the stolen total had already been approved for victim compensation funds. Instead of receiving disbursements, those victims now face indefinite delays while the court attempts to claw back remaining assets converted into fiat and physical luxury goods. The case further underscores that even robust data security guidelines are worthless when trusted insiders maintain unilateral access to raw cryptographic credentials without immediate automated multi-sig escrow.

Vance was arrested early Thursday at his residence in suburban Sacramento. If convicted on all counts, he faces a statutory maximum of 40 years in federal prison. The Department of Justice stated that an expanded internal review is now auditing all digital asset seizures Vance handled during his seven-year tenure with the cyber task force.