US probes negotiator suspected of taking crypto ransomware money