Iranian hackers taunted former National Security Advisor John Bolton about files allegedly obtained from his email account that they said were classified, wishing ‘good luck’ to ‘Mr. Mustache’ as they threatened to leak the materials, an unsealed search warrant affidavit reviewed by Fox News Digital revealed.
Bolton pleaded not guilty in October to eight counts of transmission of national defense information and ten counts of retention of national defense information. He had been indicted on 18 counts related to the improper handling of classified materials.
It was July 2021 when Bolton’s assistant contacted the FBI via email to alert the agency that Iran had obtained access to Bolton’s email account, according to the affidavit. Bolton’s team had notified the FBI that it would be deleting Bolton’s emails so the hackers could not obtain any additional sensitive information.
Weeks later, Bolton’s assistant contacted the FBI again to say he had received threatening emails that were believed to be related to the hack of Bolton’s AOL account.
‘The e-mail, the subject of which was ‘Re:New PW,’ as forwarded to the FBI, stated: ‘I do not think you would be interested in the FBI being aware of the leaked content of John’s email (some of which have been attached), especially after the recent acquittal. This could be the biggest scandal since Hillary’s emails were leaked, but this time on the GOP side! Contact me before it’s too late,’’ according to the warrant.
In August 2021, Bolton’s assistant flagged another email from the same account that threatened to leak portions of Bolton’s manuscript found in his email.
‘OK John…as you want (apparently), we’ll disseminate the expurgated sections of your book by reference to your leaked email,’ the email said. ‘Good luck Mr. Mustache!’
The affidavit in support of the search warrant from a raid on Bolton’s home in September was unsealed and obtained by Fox News Digital.
The affidavit supporting the search warrant revealed additional details about the case against Bolton.
‘CLASSIFIED INFORMATION’
According to the unsealed warrant, staff from the White House National Security Council visited Bolton’s home Sept. 10, 2019, to retrieve classified information and any government property after his termination as national security advisor.
The government had created a sensitive compartmented information facility, also known as a SCIF, in Bolton’s home Sept. 17, 2018. That SCIF was decertified Oct. 16, 2019, according to the warrant.
‘Based on my education, training and experience, I know that the installation of a SCIF within the TARGET RESIDENCE indicated that Bolton anticipated storing classified materials within the TARGET RESIDENCE during his tenure as APNSA,’ the affidavit states.
‘Once he was no longer APNSA, effective Sept. 10, 2019, his need-to-know expired, and any authorization for having access to the classified documents in the TARGET RESIDENCE was subsequently revoked.’
It was December 2019 when Bolton submitted a draft of his manuscript of ‘The Room Where It Happened,’ his memoir, to Ellen Knight, the National Security Council senior director for records, access and information security management.
Knight acknowledged receipt of the manuscript, according to the warrant, and notified Bolton that ‘based on a preliminary review, the manuscript appeared to contain significant amounts of classified information, to include information classified at the TOP SECRET level.’
Knight suggested Bolton modify and resubmit the manuscript due to the ‘large volume of classified information contained’ in it.
‘Knight indicated that, in all her experience, she had never seen that level of classified material and specificity of detail in a manuscript submitted for review,’ the affidavit said. ‘There were quotes from foreign leaders from negotiations with the President and details of foreign military actions which had not yet been publicly acknowledged by the foreign governments.
‘Based on her experience in reviewing manuscripts for pre-publication review and the level of detail contained in Bolton’s submission, Knight surmised that Bolton either had an incredible memory or had to be writing from notes he would have taken as APNSA. Knight explained that any such notes were likely classified, fall under the PRA, and should have been turned over by Bolton at the conclusion of his government service,’ the affidavit read.
But on Dec. 13, 2019, Bolton’s team confirmed he had cleared classified documents and did not possess any additional classified documents at his home.
The affidavit, though, revealed that in February 2020, Bolton’s assistant wrote an email to the National Security Council to notify it that Bolton was reinstalling a SCIF in his home and needed the contact information for someone at the National Security Council who could accredit the SCIF. That was unusual, according to the warrant, given Bolton was no longer an employee of the U.S. government.
The National Security Council director of security responded the same day, telling Bolton and his team that installing an accredited SCIF in his home was ‘not a viable option.’
It was more than a year later that Bolton’s AOL email account was hacked by a foreign entity, believed to be Iran.
Meanwhile, while Bolton attempted, and failed, to get a second SCIF accredited in his home, Bolton continued to refer to ‘the archives’ in emails to himself and to two other individuals, whose identities remain redacted.
The warrant states that Bolton would designate ‘certain information’ for ‘the archive,’ which the warrant states is likely a physical space within his home.
‘POLITICAL REASONS’
The probe into Bolton’s alleged retention of classified documents was first launched years ago but later shut down by the Biden administration ‘for political reasons,’ according to a senior U.S. official.
The Justice Department during Trump’s first administration argued that Bolton’s 2020 memoir contained classified material and sought to block its publication. A federal judge ultimately allowed the book to be published.
Justice Department lawyers argued the book contained classified national security information covering areas like U.S. intelligence sources and methods, foreign policy deliberations and conversations with foreign leaders.
In June 2021, the Biden Justice Department abandoned both a criminal inquiry and civil lawsuit against Bolton over the memoir, ending the legal battle at that time.
Bolton’s attorney said at the time that a senior career official in charge of the National Security Council’s pre-publication review process conducted a four-month review of the book and, after requiring a number of revisions, concluded that it contained no classified information.
The book contained a damning account of the Trump White House, alleging that Trump once ‘pleaded’ with Chinese President Xi Jinping to aid his re-election campaign, among other missteps.
Trump ousted Bolton from his first administration in 2019 because the pair ‘disagreed strongly’ on policy.
Bolton has both praised and criticized Trump since leaving his first administration.
He criticized Trump’s handling of classified documents, which led to an FBI raid on the former president’s Mar-a-Lago home in 2022 and a subsequent federal indictment but insisted that ‘the legal process play out.’
Trump initially was indicted on 37 felony counts, later expanded to 40, but the case was ultimately dismissed in July 2024.
In 2022, Bolton said Trump lacked the competence and character to be president.
However, Bolton strongly backed Trump’s military strike on Iran’s nuclear facilities in June, calling it ‘a decisive action,’ ‘the right thing to do’ and praising its potential to generate ‘huge change in the Middle East.’
Trump, meanwhile, often has criticized Bolton for pushing U.S. involvement in wars in the Middle East. Bolton served as U.S. ambassador to the United Nations under President George W. Bush from August 2005 to December 2006.
Trump revoked Bolton’s Secret Service detail Jan. 21, the day after Trump’s inauguration as the 47th president, and Bolton said the move showed that Trump was coming after him.
‘I think it is a retribution presidency,’ Bolton told ABC earlier in 2025, responding to Trump’s move to revoke his security clearance.
Bolton has faced threats from Iran going back years, including an alleged plot to assassinate him in 2021 and the Department of Justice subsequently charging a member of Iran’s Islamic Revolutionary Guard Corps for the plot in 2022.
The Iranian threats against Bolton were likely sparked by the January 2020 U.S. strike that killed Qassem Soleimani, the head of Iran’s Quds Force, the Department of Justice reported in 2022.
Bolton pleaded not guilty to 18 counts in October.
U.S. Magistrate Judge Timothy Sullivan explained the charges to Bolton and asked if he understood them and the potential penalties of up to ten years per count and a maximum fine of $250,000 per count.
‘I do your honor,’ Bolton said during his arraignment at the federal courthouse in Greenbelt, Maryland.
‘From on or about April 9, 2018, through at least on or about August 22, 2025, BOLTON abused his position as National Security Advisor by sharing more than a thousand pages of information about his day-to-day activities as the National Security Advisor — including information relating to the national defense which was classified up to the TOP SECRET/SCI level — with two unauthorized individuals, namely Individuals 1 and 2,’ the indictment states.
‘BOLTON also unlawfully retained documents, writings, and notes relating to the national defense, including information classified up to the TOP SECRET/SCI level, in his home in Montgomery County, Maryland.’
The documents Bolton allegedly transmitted were sent to two individuals unauthorized to view classified documents, the indictment said.
Those documents, according to the indictment, revealed intelligence about future attacks by an adversarial group in another country, a liaison partner sharing sensitive information with the U.S. intelligence community, intelligence that a foreign adversary was planning a missile launch in the future and a covert action in a foreign country that was related to sensitive intergovernmental actions, among other information.
‘The FBI’s investigation revealed that John Bolton allegedly transmitted top-secret information using personal online accounts and retained said documents in his house in direct violation of federal law,’ said FBI Director Kash Patel.
‘The case was based on meticulous work from dedicated career professionals at the FBI who followed the facts without fear or favor. Weaponization of justice will not be tolerated, and this FBI will stop at nothing to bring to justice anyone who threatens our national security.’
Bolton did not immediately respond to Fox News Digital’s request for comment.