Patrick Steven Yaroch, a former FBI agent, pleaded guilty on November 5 to wire fraud and money laundering after using cryptocurrency wallet credentials gathered in FBI investigations to steal about $2.47 million.
The Justice Department said he made nearly 100 unauthorised transfers from wallets tied to 35 cases, including one the FBI created for an undercover operation. He faces up to 20 years in prison and will be sentenced on March 4, 2027.
How Yaroch exploited FBI access to steal millions
Court documents reveal that Yaroch’s position within the FBI gave him access to sensitive systems containing cryptocurrency credentials collected during investigations.
He worked in the FBI’s Boston Division from 2017 until early 2025, serving on an investigative squad focused on an unnamed adversarial nation-state. In February 2025, he moved to the bureau’s Counterintelligence and Espionage Division, where he continued to have access to systems containing information gathered during cryptocurrency-related investigations.
Prosecutors said the scheme began no later than December 2024. Rather than using the information strictly for official investigative purposes, Yaroch exploited his access to obtain cryptocurrency from wallets connected to separate cases.
The scale of the operation was substantial. According to the DOJ, he carried out approximately 100 fraudulent transfers using credentials associated with 35 different FBI investigations. The total proceeds amounted to approximately $2,474,380.66.
The Crypto theft was not limited to assets belonging to suspected criminals. At least one targeted wallet had been created by the FBI itself for operational purposes, adding another layer of concern to the case.
After obtaining the digital assets, Yaroch exchanged them for other cryptocurrencies and conducted additional transactions to make tracing their original source, ownership and movement more difficult.
Prosecutors also identified personal financial benefits from the scheme. Between November 25, 2025, and January 13, 2026, Yaroch moved approximately $93,082 into one of his accounts before transferring the money through other accounts. Some of the funds went toward credit card bills, vehicle payments and outstanding loans.
ChatGPT, a Portuguese Vineyard and plans to start over
Beyond the financial misconduct, details surrounding Yaroch’s intended use of the stolen cryptocurrency have attracted considerable attention.
According to prosecutors, the former agent explored the possibility of relocating to Europe and using his illicit proceeds to establish a different lifestyle abroad.
He turned to ChatGPT for guidance on investment opportunities and potential places to settle within the European Union. The chatbot reportedly suggested purchasing a vineyard in Portugal as one possible route toward a new lifestyle.
Yaroch subsequently took steps to turn the idea into a practical plan. On June 15, 2026, he granted Portuguese lawyers power of attorney to represent him before the country’s Tax and Customs Authority.
Their responsibilities included registering him with the Portuguese tax authorities, obtaining a tax identification number and collecting credentials that would allow him to access his financial portal.
He also arranged a trip to Portugal for September 2026.
The development adds an unusual dimension to the Crypto theft investigation, illustrating how the alleged proceeds were connected not only to debt repayment but also to plans for a substantial change in lifestyle.
However, the Portugal arrangements did not prevent investigators from uncovering the scheme. The case eventually exposed the misuse of confidential information and the extent to which the former agent’s actions had affected ongoing national security and criminal investigations.
Confession exposes damage to FBI investigations
Yaroch’s misconduct eventually came to light after he acknowledged his actions to a former colleague at the Justice Department’s National Security Division.
According to an FBI affidavit, he turned himself in on July 29, 2026, and admitted that he had made serious mistakes involving cryptocurrency wallets. He reportedly expressed frustration that the bureau had not taken action against certain cryptocurrency accounts associated with an adversary, explaining that he had decided to take matters into his own hands.
His initial account significantly underestimated the scale of the operation. He reportedly described approximately 10 to 12 transfers worth less than $1 million, while subsequent findings established nearly 100 fraudulent transactions and proceeds exceeding $2.47 million.
Two days later, investigators searched his residence and recovered a Trezor hardware wallet, three passports and a handwritten document containing cryptocurrency recovery phrases, according to the earlier FBI affidavit.
Investigators also identified cryptocurrency holdings connected to his Kraken account and assets deposited through Suilend, a lending protocol operating on the Sui blockchain. Approximately $925,000 was subsequently transferred from accounts under his control into government-controlled wallets, according to the affidavit.
The broader consequences of the Crypto theft extended beyond financial losses. The DOJ said Yaroch’s conduct compromised multiple investigations involving criminal organizations and nation-state adversaries. It also affected FBI personnel’s ability to perform their duties and exposed sensitive sources and methods used in intelligence collection and criminal investigations.
Theophani K. Stamos, First Assistant U.S. Attorney for the Eastern District of Virginia, and Daniel S. Wierzbicki, Special Agent in Charge of the FBI Washington Field Office’s Counterintelligence Division, announced the guilty plea.
$2.47 million case raises questions about internal security
The guilty plea highlights the risks associated with centralized access to sensitive cryptocurrency information, particularly when investigative credentials can also provide the ability to control digital assets.
Unlike conventional bank transfers, cryptocurrency transactions can move assets across multiple wallets and blockchain networks. Although transactions on public blockchains may leave traceable records, identifying the individuals controlling the destination wallets and recovering the funds can require extensive investigative work.
The Crypto theft case also demonstrates why law enforcement agencies must maintain strict separation between access to investigative evidence and the authority to move or control assets connected to those investigations.
For cryptocurrency holders and institutions, the incident reinforces the importance of access restrictions, transaction monitoring, independent oversight and secure management of wallet credentials.
Yaroch is now awaiting sentencing, with the March 4, 2027, hearing expected to determine the consequences of his guilty plea. While he faces up to two decades in prison, the judge will consider the applicable federal sentencing framework before issuing a final decision.
Ultimately, the Crypto theft investigation serves as a reminder that digital asset security threats do not always originate from anonymous hackers or organized cybercriminals. In this case, prosecutors identified an insider whose professional access became the means through which millions of dollars in cryptocurrency were taken.