Chris Tarbell

Tarbell recounts that he originally studied to become a doctor but turned toward law enforcement after joining his university’s Campus Cadets; in 1998 a police sergeant convinced him that computers would become part of every crime, and he switched to computer science, joining the police after college.⁠[1]

He earned a bachelor’s degree and a master’s in computer science (information security concentration) from James Madison University, and later investigated computer-related crimes with two police departments.⁠[2]

From 2005 to 2009 he was an FBI computer forensic examiner; in 2009 he joined CY-2, a cybercrime squad in the New York Field Office, as a special agent.⁠[3]

He was initially hired as a CART forensic examiner stationed at Quantico, taking part in rapid-response investigations related to terrorism, botnets and other cybercrimes, and was later appointed a special agent and assigned to the cybercrime squad in New York.⁠[4]

On the evening of June 7, 2011, Tarbell and another special agent went to an apartment in New York’s Jacob Riis Houses and found LulzSec member Hector Xavier Monsegur, known online as Sabu; Monsegur had once logged into an IRC chat room without masking his IP address, a slip that led investigators to his door.⁠[5]

Monsegur was brought to the FBI’s New York office the night of his arrest, and Tarbell turned him into an informant; the FBI set him up with a laptop in its office, where he gathered evidence against his LulzSec associates, and about nine months later dozens of arrests followed.⁠[6]

On March 6, 2012, the U.S. Attorney’s Office for the Southern District of New York announced charges against five hackers who identified themselves with Anonymous, Internet Feds or LulzSec, over hacks including those of Fox Broadcasting Company, Sony Pictures Entertainment and PBS; Monsegur had pleaded guilty to a 12-count information on August 15, 2011, and his plea was unsealed that day. At the same time, AntiSec member Jeremy Hammond was arrested in Chicago and charged over the hack of Stratfor.⁠[7]

After the LulzSec case, Tarbell turned his attention to the Tor anonymity network; after several pitches to his superiors, in February 2013 he opened the FBI’s first Tor case, Operation Onion Peeler.⁠[6]

He recounts that the operation initially targeted 26 onion sites on Tor that sold hacking services, hackers for hire or hacking tools; Silk Road was sixth on the list in the case file, but the team saw it as the biggest prize.⁠[1]

In a court declaration, Tarbell stated that in early June 2013 he and a colleague found a non-Tor IP address in packets returned by Silk Road’s login page; visiting it in an ordinary browser brought up the site’s CAPTCHA, indicating the server’s true address.⁠[3]

The address led to the Thor Data Center in Iceland; Tarbell then travelled to Reykjavik, where Icelandic police removed the server’s mirror drive and handed it to him.⁠[8]

On the afternoon of October 1, 2013, with Tarbell in charge on the ground, FBI personnel arrested Ross Ulbricht at the Glen Park Branch Library in San Francisco and seized his laptop while it was still logged in; a CY-2 member in Iceland simultaneously moved Silk Road’s bitcoins into an FBI account.⁠[8]

The detailed criminal complaint Tarbell wrote to seek Ulbricht’s arrest was made public after the arrest.⁠[5]

On May 8, 2014, FTI Consulting announced that Tarbell had joined its Global Risk and Investigations Practice as a managing director based in New York, focused on cyber security and investigations.⁠[2]

Ulbricht’s lawyers asked the court to make the government prove its account that the FBI located the server through a leaking CAPTCHA; after discovery documents were released in October 2014, International Computer Science Institute researcher Nicholas Weaver argued that the server configuration and logs did not fit that account and suggested the FBI may have contacted the IP address directly.⁠[9]

In 2015 Ulbricht was sentenced to life in prison after a high-profile prosecution.⁠[10]

He was found guilty on seven counts, ranging from selling narcotics and money laundering to maintaining an “ongoing criminal enterprise.”⁠[11]

In February 2016 the consultancy Berkeley Research Group (BRG) announced it had hired a cybersecurity team led by former federal prosecutor Thomas Brown, with Tarbell and Matthew Edman joining as directors; the group had worked together on the Silk Road, Anonymous and LulzSec investigations and, after leaving government, had spent two years together at another international consulting firm.⁠[12]

On October 20, 2022, Naxo Labs, co-founded by Tarbell with former FBI computer scientist Tom Kiernan, former FBI contractor Matt Edman and cybercrime expert David Franzel, officially launched; set up in Manhattan that year, it provides cryptocurrency tracing and dark-web investigation services to law enforcement, and government contract records showed an $8 million deal with Immigration and Customs Enforcement.⁠[13]

Naxo says it is focused on cryptocurrency and serves a number of unnamed government entities; Tarbell said the crypto field is still a “wild wild west” and that not everything is what it appears to be.⁠[14]

That month he and Monsegur launched the podcast Hacker and the Fed, whose introductory episode was released on October 12, 2022; the show description says the two once faced off as adversaries in cyberspace before becoming close friends and co-hosts, discussing cybersecurity news and topics in each episode.⁠[15]

On November 22, 2022, he appeared on episode 340 of the Lex FridmanLex FridmanLex Fridman is a Soviet-born, US-raised computer scientist and podcast host who works as an MIT research scientist on human-AI interaction and autonomous driving. His Lex Fridman Podcast is known for hours-long conversations with guests including heads of state and technology leaders.Open the full entry Podcast, which introduced him as the former FBI special agent who brought down Ross Ulbricht and Hector Monsegur; topics included Silk Road, Operation Onion Peeler, mass surveillance, the dark web, Anonymous and LulzSec, and cyber war.⁠[16]

On March 29, 2024, the InfraGard National Members Alliance broadcast the webinar “We Met Through InfraGard – Hacker and The Fed,” about how Tarbell and Monsegur, by then a security researcher, met through InfraGard.⁠[17]

In January 2025, U.S. President Donald Trump announced that he had signed a “full and unconditional pardon” for Ulbricht.⁠[10]

In February 2025, speaking at the ThreatLocker Zero Trust World conference in Orlando, Tarbell said he did not want to get political and that the “new me says I hope Ross does something good with the second chance”; he also said Monsegur had humanised what a criminal was to him.⁠[11]

The SANS Institute speaker page describes him as specializing in cyber investigations and incident response, and as a founding partner of NAXO and co-host of Hacker and the Fed.⁠[18]

LinkedInLinkedInLinkedIn is a social networking platform for professionals. It was founded in 2002 by Reid Hoffman and others, launched in 2003, and listed on the New York Stock Exchange in 2011; after Microsoft acquired it for approximately $26.2 billion in 2016, it became a wholly owned Microsoft subsidiary. Its revenue comes from membership subscriptions, advertising, and recruitment solutions.Open the full entry: Public profile: https://www.linkedin.com/in/chris-tarbell-20b129278/ (opens in a new window)⁠[18]

Federal Bureau of Investigation: Official website: https://www.fbi.gov/ (opens in a new window)⁠[4]

FTI Consulting: Official website: https://www.fticonsulting.com/ (opens in a new window)⁠[2]

NAXO: Official website: https://naxo.com/ (opens in a new window)⁠[16]