Newly unsealed court documents have revealed that one of the corrupt federal agents investigating Silk Road, the online drug marketplace, is suspected of stealing hundreds of thousands of dollars worth of bitcoin—after he pleaded guilty last year.

Shaun Bridges is one of two agents who pled guilty to stealing from the Darknet market. Bridges stole about $800,000 worth of bitcoins from Silk Road drug dealers after he and a partner arrested a Silk Road admin and learned how to reset passwords. That led to Ross Ulbricht, who was convicted of running Silk Road in February 2015, attempting to order the murder of the admin, Curtis Green. Ulbricht was sentenced to life in prison last year.

Bridges' scam was later discovered, though. The former Secret Service agent, who served on a Baltimore-based task force investigating Silk Road, was arrested in March 2015 and pled guilty a few months later. In January, Bridges was arrested again just one day before he was scheduled to turn himself in. The documents unsealed Thursday shed light on why the second arrest took place.

Access not denied

In November 2014, the US Attorney in Maryland seized 1606 bitcoins, worth about $600,000 (£400,000) at the time, from various accounts at a company called Bitstamp. Bridges was the affiant on the warrant, and the funds were put into a Bitcoin wallet he created. Later, some of the account owners "disputed the legality of the warrant," according to an affidavit (PDF) signed by by IRS Special Agent Tigran Gambaryan, who headed up the Northern California-based investigation of Bridges' crimes. In September 2015, a federal court in Maryland ordered the US Secret Service to return $30,616 worth of bitcoins to the affected Bitstamp clients.

When the Secret Service accessed the wallet, however, the the bitcoins were gone. They'd been moved on July 28, after Bridges signed his guilty plea.

The affidavit doesn't outright state that Bridges took the money, but it looks mighty suspicious. It's possible that other employees had access, but "at present the only individual that is conclusively known to have access was Bridges." Secret Service had never revoked Bridges' access to the wallet, even after he had been arrested and the agents were warned to do so. About a dozen other Secret Service employees were interviewed and all reported they did not have access to the wallet.

The stolen money was moved into an account at BTC-e associated with the e-mail account "branstein.gustaf@outlook.com." BTC-e is an unregistered foreign Bitcoin exchange that "operates without appropriate anti-money laundering" policies, according to the government. BTC-e ultimately did provide some records, but the logs showed that the money was accessed through Tor and run through a Bitcoin tumbler. When he was a federal agent, Bridges was a specialist in tumbler and the user of Tor.

The affidavit also recounts how Bridges petitioned a Maryland state court to change his name from "Shaun Wesley Bridges" to "Calogero Esposito." (Bridges' wife's last name is Esposito). Bridges, who sought to have the name change sealed from the public record, neglected to mention that he had been arrested and was scheduled to plead guilty to money-laundering charges. His petition for a name change was denied, but he re-petitioned two more times.

Bridges' PayPal account also showed that he had attempted to order a birth certificate from a company that claims to provide German documents.

The affidavit also asks for a warrant to obtain records from Microsoft related to the "branstein.gustaf@outlook.com" address, saying there's probable cause the account was related to the theft.

While the documents lay out what the government was thinking in late January, there's no indication of where the investigation proceeded after that. Bridges has begun serving his original sentence at the federal prison in Terre Haute, Indiana. It isn't clear if or when additional charges will be filed against him.