Ex-FBI Agent Admits Stealing $2.47 Million in Crypto From Bureau Investigations
A former FBI counterintelligence supervisor has pleaded guilty to stealing about $2.47 million in cryptocurrency from wallets the bureau was investigating, using credentials he could reach through the FBI’s own systems.
Patrick Steven Yaroch, 37, of Ashburn, Virginia, admitted wire fraud and money laundering in federal court in Alexandria on 5 November, the Justice Department said. Prosecutors said he made about 100 fraudulent transfers using credentials tied to 35 separate FBI investigations, taking $2,474,380.66 in total.
A scheme that ran for more than a year
According to court documents, Yaroch worked at the FBI Boston Division from 2017 until early 2025, on a squad focused on an adversarial nation state. From February 2025 until 31 July 2026, he worked in the bureau’s Counterintelligence and Espionage Division, with access to systems holding cryptocurrency credentials collected during investigations.
Prosecutors said the theft began no later than December 2024. He drained wallets controlled by the subjects of other investigations, by adversarial nation-state actors, and at least one wallet the FBI itself had created for an operation. The Record reported that the transfers touched 79 wallets, including accounts linked to at least two adversarial countries. NBC News reported that one of the countries was Russia, citing two sources. Gizmodo, citing the Washington Post, reported that some of the money belonged to at least ten victims of financial crimes the bureau was investigating.
He then swapped the stolen coins into other cryptocurrencies and moved them through further transactions to hide their origin, the Justice Department said.
He confessed — then planned a new life abroad
The case came to light because Yaroch reported himself. On 29 July, he told an employee of the Justice Department’s National Security Division that he had made “very poor decisions” involving cryptocurrency wallets and that the situation was “eating him up inside”, according to court records.
He was arrested and fired on 31 July. When prosecutors first charged him in August, they put the theft at about $1 million. The statement of facts attached to his plea more than doubled that figure.
Court records also describe preparations for a life outside the United States. According to an FBI affidavit, Yaroch asked ChatGPT how to invest about $1 million and where in the European Union to settle, and the chatbot ranked Portugal as its top choice; one report said it suggested a Portuguese vineyard. He gave Portuguese lawyers power of attorney on 15 June to register him with tax authorities, after travelling to Portugal in May without telling the federal government, and he had booked another family trip for September when he was arrested in July. Agents seized a crypto hardware wallet, multiple passports and handwritten notes consistent with crypto seed phrases.
The affidavit said about $188,600 sat in a Kraken account, mostly in US dollars and the USDC stablecoin, with a further $933,800 in Suilend, a lending protocol on the Sui blockchain.
What happens next
Yaroch is due to be sentenced on 4 March 2027 and faces up to 20 years in prison. U.S. District Judge Patricia Tolliver Giles accepted the plea. The case is numbered 1:26-CR-208 in the Eastern District of Virginia.
Prosecutors said, according to the Washington Post: “The evidence is clear that the defendant planned to use this cryptocurrency for his own personal enrichment, just like any other fraudster.”
The Justice Department’s release gives no figure for how much of the $2,474,380.66 was recovered, and no forfeiture or restitution figure. The Justice Department’s Office of the Inspector General, Mid-Atlantic Region, provided what the release called “significant assistance” — a pointer to an oversight review that has not been published.
The case is the latest federal action touching cryptocurrency crime. North Korea denied any role in a $6.3 billion Binance hack that the FBI linked to Pyongyang, and the United States cut the MEXC exchange off from the financial system over alleged laundering. In Washington, a man was arrested near the White House this week after officers found guns in a stolen vehicle.
[…] weakness matters because multi-factor authentication is often the last line of defence once a password has been stolen. If an attacker can present credentials for a different login method and skip the SAML step […]