FBI Agent Pleads Guilty to Draining $2.47 Million From 35 Cases

A former FBI agent admitted in federal court in Alexandria, Virginia, on Nov. 5 that he used bureau credentials to drain cryptocurrency wallets the FBI was investigating. Patrick Steven Yaroch, 37, of Ashburn, pleaded guilty to wire fraud and money laundering tied to about 100 fraudulent transfers, credentials connected to 35 separate investigations, and $2,474,380.66 in proceeds, according to the Department of Justice .

The number is the story. When the FBI arrested Yaroch in August, our reporting on the case put the alleged loss at roughly $1 million ( the arrest-stage account ). The statement of facts attached to the plea lifts that by $1,474,380.66, or 147%, and states the total to the cent.

Cents in a criminal filing are not decoration. They come from traced transfers, which means investigators hold a per-transaction map of the scheme. That map is the part the crypto industry should read closely, because it describes a failure that has nothing to do with breaking cryptography and everything to do with who holds the keys, and for how long nobody checks.

From $1 Million at Arrest to $2.47 Million at the Plea

The arrest-stage allegation described an agent with top-secret clearance accused of stealing from wallets held inside FBI investigations. The plea describes a longer run and a wider blast radius. According to the release, Yaroch worked at the FBI Boston Division from 2017 through early 2025 on an investigative squad focused on an adversarial nation state, then moved into the FBI’s Counterintelligence and Espionage Division from February 2025 through July 31, 2026, with access to systems that contained “cryptocurrency credentials that the FBI had collected as part of its investigations.”

The theft, as the filing describes it, began “no later than December 2024” and reached wallets controlled by the subjects of other investigations, by adversarial nation state actors, and, in at least one case, “at least one wallet the FBI created to use in an operation.”

Read that window again. Roughly 20 months passed between the first alleged theft and the day his access ended. A credential store that absorbs 20 months of misuse is not a phishing problem, and it is not a training problem either. It is a monitoring problem, and the monitoring that failed sat inside the division responsible for counterintelligence.

The mechanics were deliberately dull, which is why they worked. Yaroch moved the stolen coins, swapped them into a different cryptocurrency, then laundered them “to obfuscate its source, nature, and ownership,” the release states. The interest was about $2.47 million. The method was a trained investigator’s understanding of how case wallets are accessed and how on-chain hops are traced.

Roughly 100 Transfers, 35 Case Files, One Set of Credentials

Two figures carry more weight than the dollar total. The first is 35, the number of separate FBI investigations whose credentials he used. The second is roughly 100, the count of fraudulent transfers. Those two counts describe how the scheme scaled: he did not need to compromise a wallet 35 times. He needed one class of access, repeated at small size, across many files.

The release also fixes a personal-finance trail that reads like a case study in how stolen crypto becomes ordinary money. Between Nov. 25, 2025, and Jan. 13, 2026, Yaroch moved approximately $93,082 into one account, shifted funds between his accounts, and paid credit cards, car payments and other loans. He also asked ChatGPT how to maximize profit from investments and where to live in the European Union. Following a suggestion about buying a vineyard in Portugal, he gave power of attorney to lawyers in Portugal on June 15, 2026 to register him, obtain a tax identification number and collect his finance portal password, and he arranged travel there for September 2026.

Then the bureaucratic layer, which is where the case stops being a personal story. In the agreed statement of facts, the release says his actions “compromised multiple FBI investigations related to both criminal groups and nation state adversaries,” “deprived FBI employees of their ability to carry out their functions to protect public safety and national security,” and “also compromised FBI sources and methods used in foreign intelligence collection and criminal investigations.”

Date	What the record shows
2017 to early 2025	FBI Boston Division, squad focused on an adversarial nation state
No later than Dec. 2024	First alleged thefts from investigation wallets
Feb. 2025 to July 31, 2026	Counterintelligence and Espionage Division; access to stored crypto credentials
Nov. 25, 2025 to Jan. 13, 2026	Approximately $93,082 moved through one account and then across his accounts
June 15, 2026	Power of attorney to Portuguese lawyers; tax ID and finance portal access
Nov. 5, 2026	Guilty plea to wire fraud and money laundering before Judge Patricia Tolliver Giles
March 4, 2027	Sentencing date; statutory maximum of 20 years

The Per-Case Arithmetic

Divide the total by the case count and the average lands at $70,696.59 per investigation touched. Divide it by the transfer count and the average per transfer is $24,743.81. Neither number is large by the standards of exchange breaches, and that is precisely why the scheme survived: individual transfers of that size do not trip the thresholds that compliance systems and internal reviews are tuned to watch.

The personal-account funnel is smaller still. The $93,082 that passed through a single account between late November and mid-January equals 3.76% of the total proceeds, or about $1,861 a day across 50 days. A person moving roughly $1,800 a day through his own bank accounts is behaving like a salaried professional with a side income, not like someone laundering eight figures. Whatever controls caught him, it was not transaction-size monitoring on his personal banking.

The arithmetic has one hard limit. It measures what the government says he took, not what anyone recovered. The release gives no recovery figure, so any assumption that the coins came back is unsupported.

Why Seizure Custody Is the Part Victims Should Read

For anyone waiting on a hack recovery, this case touches the least discussed leg of the process. Tracing stolen coins is the visible, well-funded part: analytics vendors, exchanges, bridges and law enforcement cooperate, funds get frozen, and a portion returns. Custody is the quiet part. Between seizure and restitution, coins sit in wallets controlled by agencies whose credential hygiene is rarely audited in public, and the same is true of exchange and receiver wallets in bankruptcy and enforcement cases.

Nothing in the release alleges that Yaroch sold the stolen coins into public markets, manipulated a price, or touched a trading venue. That distinction matters, because it separates a market event from an institutional one. The damage here is to investigations and to the credibility of the custody chain that every future recovery depends on. A defence lawyer in any of the 35 affected matters now has a documented reason to ask who held the keys, who could move funds, and whether chain of custody was intact for the evidence in their case.

An Insider and a Vendor Breach in the Same Week

The timing is uncomfortable. A day before the plea, Chainalysis told customers that names, usernames, password hashes and live authentication tokens belonging to all of its users had been exposed, a broader disclosure than its first breach notice, as we reported on Nov. 6 . Nine of eleven product components were still under maintenance at the time of that report, including the KYT interface and API that compliance teams use to screen payments.

Two different failures, one shared conclusion. The Chainalysis incident is an external intrusion against a vendor that the enforcement and compliance stack depends on. The Yaroch case is internal abuse by someone the bureau vetted and cleared. The fixes diverge sharply: token rotation, IP allowlisting and network segmentation address the vendor breach, while least-privilege design, split key custody, dual control and behavioural monitoring on credential use address the insider one. What they have in common is that both treated access as a perimeter question when the evidence says access is a continuous one.

The countercase deserves a hearing. Federal seizure wallets are not exchange hot wallets, they hold relatively few assets for long periods, and the Bureau’s exposure to a single insider is bounded by the number of files one agent can reach. On that reading, this is a serious personnel and process failure with limited systemic weight. The weakness in that argument is the 35 figure. One agent reached 35 files, which suggests the access model was broad by default rather than narrow by design.

What the Plea Document Leaves Open

The release is precise about what was taken and silent on several things a reader would want. It gives no forfeiture or restitution figure. It does not say whether any of the $2,474,380.66 was recovered or in what form. It does not state a sentencing range under the guidelines, and the 20-year figure is the statutory maximum for the charges, not a forecast. It does not describe the condition of the 35 investigations, whether any prosecution was dropped, or whether any defendant was notified that the evidence against them passed through compromised hands.

Two procedural details do carry forward. The Justice Department’s Office of the Inspector General, Mid-Atlantic Region, provided “significant assistance,” which points to an oversight review that has not been published. And the case number, 1:26-CR-208 in the Eastern District of Virginia, means the plea agreement and statement of facts are retrievable through PACER by anyone who wants the underlying detail rather than the summary.

March 4, 2027 and the Signals Before It

The sentencing date gives the story a clock. Before it, watch three things. First, whether the government files a forfeiture motion that names a dollar amount and an asset list, which would clarify how much of the crypto still exists. Second, whether the Inspector General publishes findings on credential controls for seized assets, because that document would apply well beyond this case. Third, whether defence counsel in the affected matters seek disclosure, which would turn a personnel case into a procedural one for the courts.

For the industry, the practical lesson is narrower than “insider risk.” Bearer assets held in trust concentrate risk at the key, not at the perimeter, and that applies to exchange proof-of-reserves wallets, custodian arrangements and seizure wallets alike. A reserve attestation that proves a balance exists says nothing about who can move it or whether movement would be noticed within a week.

Yaroch took $2.47 million across 35 investigations over roughly 20 months, and the case became public through a plea rather than through a detection system the bureau has described. The dollar amount will not move a market. The control gap it documents should change how anyone holding seized or client crypto answers a simple question: who can sign, and who is watching the signature.