Former FBI agent stole crypto from 35 of the bureau’s investigations
What happens when the person with access to an investigation’s data uses the credentials to drain the wallets?
Former FBI agent Patrick Steven Yaroch pleaded guilty on November 5, 2026 to wire fraud and money laundering, admitting to stealing cryptocurrency worth $2,474,380.66. According to the US Attorney’s Office for the Eastern District of Virginia, he used access credentials from 35 of the bureau’s investigations; sentencing has been set for March 4, 2027.
How did he steal crypto from FBI investigations?
Yaroch exploited his official access to systems that stored wallet credentials, i.e. the information needed to control them. As Bitcoin Magazine reports, citing court documents and the prosecutors’ announcement, he made about 100 fraudulent transfers to wallets he controlled.
The money came from wallets belonging to people under investigation, actors linked to adversary nations and at least one wallet the FBI itself had created for an operation.
The activity had begun no later than December 2024. The 37-year-old served from 2017 until early 2025 in Boston, on a squad focused on an adversary nation, and then in the counterintelligence division at FBI headquarters, until July 31, 2026.
Where did the stolen crypto end up?
Part of the money went toward personal debts, while the conversions and further transactions were aimed at hiding where it came from. Yaroch swapped the stolen crypto for other digital assets and kept moving the funds to conceal their ownership and nature.
Between November 25, 2025 and January 13, 2026, he transferred about $93,082 to one of his accounts. Money was then moved between accounts to pay credit cards, a car and loans.
The case file also describes plans to settle in Portugal. He had asked ChatGPT about investment returns and places to live in the European Union, and the chatbot suggested buying a vineyard in Portugal. On June 15, 2026, he authorized Portuguese lawyers to handle tax formalities and had booked a trip for September.
What damage did he do to the investigations?
Beyond the financial loss, the case hit FBI investigations and intelligence methods. According to the agreed statement of facts, cases involving criminal groups and adversary nations were affected, as well as intelligence sources and collection methods.
Yaroch had himself reported his activity to two Justice Department employees on July 29, 2026. The initial description of the case involved about ten transfers totaling $1 million. The guilty plea now reflects a much larger scale.
He faces up to 20 years in prison. That is the maximum cited, not a sentence that has already been handed down.
What does the case show about wallet security?
This theft is attributed to an insider abusing his access, not to a hack of any blockchain. The custodian had the keys and, by his own admission, used them for his own benefit.
We think that’s the real issue here, as Crypto Briefing also points out in noting the need for stronger internal controls. For readers in Greece assessing a custody service, the useful question is a concrete one: who can move the assets, and who controls that access? An organization’s prestige doesn’t answer that on its own.