FBI Agent Charged With Stealing $1M in Crypto From Target

A former FBI supervisory special agent stands accused of stealing roughly $1 million in cryptocurrency from wallets tied to a foreign intelligence target. Patrick Steven Yaroch, 41, was arrested July 31 at his Ashburn, Virginia, home and taken to the Alexandria Detention Center. Federal prosecutors filed a criminal complaint the same day in the U.S. District Court for the Eastern District of Virginia, charging him with interstate transportation of stolen property and receipt of stolen property.

Yaroch spent about eight years handling national security investigations in the FBI's Boston Division before moving into a supervisory position at FBI headquarters in early 2025. That assignment placed him inside the Counterintelligence and Espionage Division with access to highly restricted intelligence systems. Cases involving cryptocurrency routinely require investigators to secure wallet credentials as evidence, making chain-of-custody and internal access controls as important as the blockchain itself.

According to an affidavit from an FBI Washington Field Office counterintelligence agent, Yaroch discovered seed phrases, the recovery words that provide complete control over a cryptocurrency wallet, while working on an investigation involving the foreign target in late 2024 or early 2025. Prosecutors allege he imported those recovery phrases into wallets under his own control and transferred funds from the target's accounts roughly 10 to 12 separate times.

Investigators say the alleged theft did not rely on advanced blockchain tricks or hidden exploits. Possession of valid recovery phrases is effectively ownership in cryptocurrency. Once those words are entered into compatible wallet software, transactions appear legitimate onchain because the network cannot distinguish an authorized owner from someone who improperly obtained the credentials.

Yaroch told investigators he became frustrated watching the government fail to act against the target's cryptocurrency activity and decided to "take matters into his own hands," according to the affidavit. He also claimed he never communicated with anyone connected to the wallets and stressed that most of the funds remained parked in wallets under his control rather than being widely spent.

The investigation began with Yaroch walking through the door himself rather than agents tracking blockchain activity back to him. On July 28, he contacted a Justice Department National Security Division employee over Signal before meeting in person. According to the affidavit, he became emotional, admitted making "very poor decisions related to cryptocurrency wallets," and described the situation as "eating him up inside." The DOJ employee advised him to retain counsel and immediately report himself.

Yaroch then contacted FBI headquarters and informed security personnel that he had "screwed up." Agents arrived at his residence later that evening to recover government property and place him on administrative leave. He briefly surrendered a written list of wallet recovery phrases before withdrawing consent. According to investigators, he then stated, "I fu**ed up," before invoking his right to remain silent. The FBI terminated his employment two days later, the same day he was arrested.

Investigators traced the alleged proceeds through multiple platforms rather than finding them hidden behind elaborate laundering techniques. Roughly $188,570 sat inside a Kraken account connected to a TD Bank account that prosecutors say Yaroch accessed using facial recognition on his phone. Another $1.02 million had been transferred into Suilend, a decentralized lending protocol, through an application called Slush during late July.

According to investigators, Yaroch said he chose Suilend partly because he liked its water-droplet logo and deposited the assets there to generate yield while the cryptocurrency remained idle. That detail stands out because decentralized finance (DeFi) lending protocols routinely leave permanent onchain records, giving investigators a straightforward trail once wallet ownership is identified.

With Yaroch's consent, the FBI transferred approximately $925,426 from the Kraken and Suilend accounts into government-controlled wallets on July 31. Another $165,582 remained inside the Kraken account because the balance had already been converted into U.S. dollars and could not be recovered through the same cryptocurrency transfer process.

A review of Yaroch's phone expanded the investigation beyond the alleged cryptocurrency theft and into the realm of generative artificial intelligence. Agents recovered ChatGPT conversations from May and June in which he explored how roughly $1 million could fund retirement before age 40 while living on a vineyard in Italy or Portugal. Additional chats asked about obtaining European Union residency, with Portugal discussed based on his family's circumstances.

Investigators also found airline reservations for Yaroch, his wife and child to travel from Washington to Lisbon on Sept. 3 before returning Sept. 11. The phone reportedly contained powers of attorney prepared in mid-June authorizing Portuguese lawyers to handle tax and registration matters. Agents also identified earlier trips this year to Germany, Portugal and Grenada that allegedly were never disclosed despite security clearance reporting requirements.

Yaroch denied planning to move the cryptocurrency overseas, telling investigators the Portugal trip was intended only to visit friends.

The FBI said it moved quickly after learning of the allegations, terminating Yaroch and opening a full criminal investigation. The case now heads into federal court in Alexandria, where prosecutors will seek an indictment unless the matter is resolved through another avenue.

The filings to watch in the docket are likely to be a detention hearing, a formal indictment or a plea agreement, along with any additional charges connected to undisclosed foreign travel or security clearance reporting. The identity of the foreign intelligence target and the adversarial nation remain sealed, suggesting some of the most consequential details may not emerge until much later in the case.

For crypto market participants, the case underscores a risk that rarely gets the same attention as exchange hacks or DeFi exploits: the insider with direct access to wallet credentials. Institutional custody solutions, government asset seizures, and law enforcement investigations all rely on the same seed-phrase security model. When that model is breached by someone already authorized to hold the keys, the blockchain offers no protection. The question for exchanges and custodians is whether their own chain-of-custody procedures would catch a similar leak before it reached a prosecutor's desk.