An FBI agent's crypto theft, and what it cost

The wallets belonged to the people the FBI was investigating. So did the passphrases. According to the Justice Department, a former agent used both to move roughly $2.5 million out of FBI case files and into accounts of his own, then ran the proceeds through exchanges to cover car payments and credit cards. On Thursday, he admitted to it in court.

Patrick Steven Yaroch, 37, pleaded guilty to wire fraud and money laundering, the Justice Department said, in a case that stretches from the FBI's Boston Division to its Headquarters counterintelligence unit — and, briefly, toward a vineyard in Portugal.

An agent with access to the keys

Yaroch worked on a national security investigative squad at the FBI Boston Division from 2017 to 2025, according to the source reporting. In February 2025 he moved to the FBI Headquarters Counterintelligence and Espionage Division, where he served as a supervisory special agent until July 2026.

That career gave him something unusually valuable: access to the FBI's case management systems, and to a separate platform used to share investigative data. From those systems, prosecutors say, he pulled passphrases tied to cryptocurrency wallets — wallets belonging either to fraud victims or to suspects under FBI investigation — and used them to transfer funds out.

The proceeds did not sit still. After moving the cryptocurrency, Yaroch tried to launder it by exchanging it for other cryptocurrencies, according to court documents.

The scale of the scheme, in the government's words

The Justice Department put hard numbers on the operation. In its account, the theft was not a single opportunistic grab but a pattern spread across many separate matters.

"Throughout his wire fraud scheme, Yaroch conducted approximately 100 fraudulent transfers using credentials related to 35 separate FBI investigations. He illicitly gained approximately $2,474,380.66 in fraudulent proceeds," the Justice Department said.

— The Justice Department

The government also tied a specific slice of the money to a specific window of time, tracing how some of it was spent.

"Between Nov. 25, 2025, and Jan. 13, 2026, Yaroch transferred approximately $93,082 to one of his accounts, then transferred the funds between his other accounts from which he sent various payments to cover his debts, including credit cards, car payments, and other loans."

— The Justice Department

Those two passages do much of the work of the case: they establish both the total alleged loss and a documented trail showing where at least part of the money went.

How it came apart

The scheme ended with the agent turning himself in — at least in part. Yaroch self-reported the crypto theft on July 29 to employees of the Justice Department's National Security Division and to FBI Headquarters staff, according to the source reporting.

The FBI placed him on administrative leave the same day, July 29. He was arrested on July 31 at his residence, and the bureau fired him that day.

The sequence is compressed: a report on July 29, an arrest and termination on July 31, and a guilty plea on Thursday. It leaves little room for the usual slow unwinding that accompanies insider cases, where misconduct is often discovered through an audit long after the fact.

The damage inside the case files

Prosecutors say the money was not the only thing taken. According to the source reporting, Yaroch's actions compromised multiple FBI investigations involving both nation-state adversaries and criminal groups, as well as FBI sources and methods used in criminal investigations and foreign intelligence collection.

That is the part of the case that reaches furthest beyond the wallets. The credentials he is accused of using sat at the intersection of investigation and evidence — the point where agents, analysts, and outside partners expect a wall between case data and personal gain. Thirty-five separate investigations are cited in the government's account, a figure that describes the breadth of the exposure as much as the breadth of the theft.

ChatGPT, Lisbon, and a plan for September

Court records described in the source reporting also sketch what investigators say Yaroch was preparing to do next. He was planning to move to Portugal with his family in early September, a plan supported by flight tickets to Lisbon and power-of-attorney documents for two lawyers in Portugal to obtain a tax identification number.

Before that, he had asked ChatGPT where to live in the European Union. The question, as quoted in the source reporting, was: "If you had a bucket ofmoney (around $1 million) and you wanted to leave the USA and become a resident or citizen ofan EU country, what would you do?"

ChatGPT's response, as described in the source reporting, referenced his age and circumstances, noting a 37-year-old "with a young family, a goal of potentially retiring around 40, and a clear interest in eventually building a slower-living vineyard/agricultural lifestyle in places like Cilento or Portugal's Dão region."

The chat log is not charged conduct. It is the kind of detail that tends to surface in sentencing memos and statements of facts, and it sits oddly beside the rest of the record: a supervisory agent with counterintelligence responsibilities, asking a chatbot where a person with about a million dollars might resettle.

The charges and the sentencing date

Yaroch pleaded guilty on Thursday to wire fraud and money laundering. Each count carries a statutory maximum of 20 years in prison — up to 20 years for the wire fraud charge and another maximum of 20 years for money laundering, according to the source reporting.

He is scheduled to be sentenced on March 4. Statutory maximums are rarely the sentence actually imposed, and the source reporting does not describe any sentencing guidelines calculation.

What the numbers add up to

• Approximately 100 fraudulent transfers, per the Justice Department
• Credentials tied to 35 separate FBI investigations
• Approximately $2,474,380.66 in fraudulent proceeds
• Approximately $93,082 moved to one account between Nov. 25, 2025, and Jan. 13, 2026
• Up to 20 years maximum for wire fraud, and another 20 years maximum for money laundering
• Sentencing set for March 4

The case record is available in the underlying filings: the affidavit, the plea agreement, and the statement of facts. The Justice Department's announcement of the plea is here.

Why it matters beyond one agent

The straightforward reading is that a single insider with legitimate access can do damage that outward-facing security controls are not built to catch. The passphrases in this case were not guessed or cracked; according to the government's account, they were retrieved from systems Yaroch was entitled to use. That suggests the exposure sat in the space between authorization and oversight — a place where logs exist but where someone still has to look at them, and where the person being reviewed has a professional understanding of what reviewing looks like.

For the investigations named in the government's account, the consequences are harder to undo than the transfers. When credentials to wallets tied to nation-state adversaries and criminal groups are used improperly, the questions that follow are about whether those subjects were alerted, whether sources were exposed, and whether evidence was tainted — the sort of second-order damage that outlasts a sentencing date.

For organizations outside law enforcement, the parallel is uneasy but real. Crypto wallets secured by a passphrase are only as strong as the number of people who can read that passphrase, and every additional custodian — an examiner, a prosecutor, a supervisor, a vendor with access to a shared platform — widens the circle. This case does not say anything definitive about how common such theft is; it is one guilty plea, and the government's account has yet to be tested at sentencing. What it does show is that the custody of seized digital assets is a policy question as much as a technical one, and that the answer lives in access records rather than in cryptography.