Federal records turned over to the Senate show the man who tried to kill President Donald Trump at a 2024 Pennsylvania rally maintained a Snapchat account and other digital profiles, data a former FBI agent says could still yield a "treasure trove" of evidence.
FBI agents located a Snapchat account belonging to Thomas Matthew Crooks under the username "tom_crooks19," along with an Amazon account, a Gmail account, and an account with Mailfence, an encrypted email service, Fox News Digital reported. The findings surfaced in federal documents delivered to the U.S. Senate, first reported by the New York Post.
Crooks, a 20-year-old from Bethel Park, Pennsylvania, attempted to assassinate Trump during a campaign rally in Butler, Pennsylvania, on July 13, 2024. One person was killed and two others were seriously injured before Secret Service agents shot and killed Crooks at the scene.
The digital trail matters because it could fill a gap that has frustrated investigators and lawmakers for months: what Crooks was doing, saying, and planning in the weeks before the attack, and whether anyone else knew about it.
Snapchat is widely known for messages that disappear after they are viewed. That reputation leads many users to assume their communications are gone for good. Retired FBI Supervisory Special Agent Jason Pack told Fox News Digital that assumption is wrong.
"When you snap and that picture goes away that everything is gone, and that's not true. When I've served search warrants, there's been a treasure trove of information that has come back."
Pack emphasized that Snapchat is not fully encrypted, meaning law enforcement armed with a search warrant can recover data users believe they deleted.
"It's not like some people think when you've snapped, and then it goes away, it's totally gone. That's not entirely the case."
If Pack is right, Crooks' Snapchat account could contain messages, images, or contact records that shed light on what he was thinking and who, if anyone, he was communicating with before the attack. That possibility makes the account one of the most significant digital leads in the investigation.
Federal records have already shown that Crooks spent years building firearms skills before the Butler rally, raising questions about how long he had been preparing and whether others should have noticed warning signs.
The federal documents also show Crooks logged into his Mailfence account, an encrypted email platform designed for privacy, multiple times between April 15, 2024, and July 8, 2024. That window covers roughly three months of activity leading up to the assassination attempt, ending just five days before the Butler rally.
Pack pointed to a broader pattern in Crooks' behavior: deliberate steps to conceal his activities.
"What you do see is a pattern of trying to hide things and using aliases. And, so, if he's taking that much care to publicly not be seen picking up deliveries and those types of things, you have to assume he's probably taken just as much diligence with his social media and with [his digital footprint]."
FBI documents have previously revealed that Crooks used a "Bob Dole" alias, adding weight to Pack's assessment that the would-be assassin took calculated measures to avoid detection. A 20-year-old maintaining encrypted email accounts, aliases, and carefully managed delivery pickups is not casual internet behavior. It is operational security, the kind that makes the contents of every recovered account more important, not less.
FBI Director Kash Patel testified at a Senate Oversight Committee hearing that investigators have so far found no evidence Crooks was connected to anyone beyond his own parents.
"We found no evidence that that individual was literally even speaking to any other human being other than his parents, who he resided with."
That claim raises an obvious tension. If Crooks was truly isolated, no friends, no contacts, no co-conspirators, then why did he go to such lengths to hide his digital footprint? People with nothing to conceal do not create encrypted email accounts and use fake names for deliveries. Either the FBI has not yet cracked the full picture, or Crooks' apparent isolation is itself a product of his careful digital hygiene.
The GAO report on Secret Service policy failures before the Butler rally already documented missed warnings and breakdowns in coordination. The question of what investigators knew, and when, extends beyond the day of the shooting to the digital investigation that followed.
Fox News Digital reached out to the FBI for comment on the newly revealed accounts. No response was reported.
Nearly a year after the assassination attempt, basic questions remain unresolved. What, if anything, did the Amazon account reveal about Crooks' purchases? Was a search warrant served on Snapchat, and what came back? What did Crooks send or receive through Mailfence during those three months of logged activity? And what is the full scope of the federal documents handed to the Senate, investigative reports, warrant returns, or something else entirely?
Separately, serious questions about the security breakdown that day remain. Reports have shown that the Secret Service knew a shooter had a rifle on the roof and never relayed that information to Trump's protective detail, a failure that nearly cost the president his life.
The digital evidence trail now adds another layer. If Crooks took deliberate steps to hide his communications, and the FBI has so far found no links to other people, then either the bureau's tools have not yet penetrated his precautions or the investigation has gaps that Congress needs to press harder to close.
Trump himself has called the Butler assassination attempt a "Democratic plot" as FBI documents have continued to surface, reflecting deep frustration with the pace and transparency of the investigation.
A man tried to kill a president. He planned it for months. He used aliases, encrypted email, and an app built to erase messages. The American public deserves a full accounting, and "we found nothing" is not the same as nothing being there.
