Mentioned in This Article
1. Former FBI Agent Pleads Guilty in a Virginia Federal Court
Patrick Steven Yaroch, a 37-year-old former agent of the Federal Bureau of Investigation from Ashburn, Virginia, pleaded guilty on Thursday, November 5, to wire fraud and money laundering after stealing about $2.47 million in cryptocurrency. Prosecutors say he made roughly 100 fraudulent transfers using wallet credentials the bureau had gathered in 35 separate investigations. He faces up to 20 years in prison, and sentencing is set for March 4, 2027.
The Justice Department announced the plea, which was entered in federal court in Alexandria. The U.S. Attorney's Office for the Eastern District of Virginia, which handled the prosecution, also publicized the outcome on social media the same day, restating the two charges to which he admitted.
Wire fraud covers schemes to obtain money or property through deceptive means that rely on electronic communications or transfers, and it is among the most frequently used federal fraud statutes. Money laundering, in turn, covers moving or disguising the proceeds of a crime so they appear legitimate. Together the two counts describe the shape of the case: a theft carried out over digital rails, followed by steps meant to hide where the funds came from.
The headline figure is about $2.5 million, while the plea documents describe $2.47 million; the two numbers are consistent once rounded. What sets the case apart from most crypto thefts is not the amount but the identity of the thief and the source of the access. The credentials did not come from phishing or a software exploit. They came from inside the government's own evidence holdings.
2. How Did a Federal Agent Get Access to the Wallets?
The answer lies in Yaroch's career path. He worked in the FBI's Boston Division from 2017 until early 2025, on a squad that investigated what court papers describe only as an adversarial nation state. He then transferred to the bureau's Counterintelligence and Espionage Division, where he had access to FBI systems that held cryptocurrency credentials collected during investigations.
Investigators routinely gather such credentials when they seize devices or obtain recovery phrases and private keys from suspects. Whoever holds those secrets can move the funds, because a blockchain wallet has no account holder to call and no fraud department to reverse a transfer. Control of the keys is, in practice, control of the money. That is why the handling of seized keys inside a law enforcement agency is a sensitive matter.
According to prosecutors, the thefts began no later than December 2024. The wallets he drained belonged to subjects of investigations and to nation-state actors, and at least one was a wallet the FBI itself had created for an operation. Drawing on credentials from 35 investigations, he carried out about 100 transfers.
He did not simply leave the coins where they landed. He swapped the stolen funds into other cryptocurrencies and passed them through additional transactions intended to hide their origin, which is the conduct underlying the money laundering count. He then used the proceeds to pay off credit cards, car payments and other loans, according to the account of the case.
3. What Did He Ask ChatGPT About Starting Over in Europe?
Prosecutors say Yaroch also prepared a move abroad. He asked OpenAI's ChatGPT chatbot how to maximize profits from his investments and where in the European Union he might settle. The assistant suggested a vineyard in Portugal.
He took the suggestion seriously enough to act on it. He gave Portuguese lawyers power of attorney so they could obtain a tax identification number on his behalf, a standard early step for anyone planning to establish residency or hold assets in the country. He had also arranged to travel to Portugal in September.
The detail is notable because it shows how ordinary consumer tools can surface in criminal files. The chatbot did nothing improper by answering general questions about investing and relocation, and nothing in the case suggests it knew the source of the money. The relevance for investigators is that the queries document intent: they show a defendant planning a life abroad while holding funds that, by the government's account, were taken from the very cases he was supposed to be protecting.
A tax ID and a travel booking are small administrative acts, but together with the transfers they paint a picture of a plan that was moving from theft toward flight. The plan was interrupted before the September trip could change the outcome.
4. A Confession That Understated the Scale
The case against Yaroch took shape largely because he came forward. According to an FBI affidavit, on July 29 he broke down while speaking with a former colleague at the Justice Department's National Security Division and said he had made very poor decisions involving crypto wallets. He then reported himself at FBI headquarters.
His explanation at that point was that he was frustrated that the bureau could not or would not act against an adversary's cryptocurrency accounts, and that he had decided to take matters into his own hands. The statement casts the thefts as a form of private enforcement, a framing the plea does not adopt: he pleaded guilty to fraud and laundering, and the funds went to his own debts and personal plans.
The admission was also incomplete. When he reported himself, he said he had made about 10 to 12 transfers worth less than $1 million. The plea describes roughly 100 transfers and about $2.47 million, a gap of close to an order of magnitude in the number of transactions.
The difference illustrates why self-reports are treated as a starting point rather than a conclusion. Blockchain transactions are recorded permanently, and investigators can reconstruct them from the public ledger and from exchange records. Once agents began tracing his activity, the full extent could be measured regardless of what he had volunteered.
5. What Agents Found When They Searched His Home
Two days after his self-report, agents searched Yaroch's home. They seized a Trezor hardware wallet, three passports and a slip of paper bearing seed phrases. A hardware wallet is a dedicated device that stores private keys offline, and a seed phrase is the list of words from which a wallet can be fully restored, so a handwritten copy is effectively a spare key to whatever it controls.
The financial trail led to two main places. His account at the exchange Kraken held about $188,600, mostly U.S. dollars and the stablecoin USDC, along with smaller amounts of the Squid token (QUID) and Bitcoin (BTC). Another $933,800 sat in Suilend, a lending protocol on the Sui blockchain, which he reached through the Slush wallet app. He told agents he chose Suilend because he liked its water-droplet logo.
Agents moved about $925,000 from those accounts into government-controlled wallets. The roughly $165,600 that Kraken held in U.S. dollars could not be moved the same way, since fiat balances at an exchange are handled through banking channels rather than by transferring a wallet.
Recovery of this kind is a key part of any asset case. A prison term addresses the offender, but the victims of a theft and the government care about getting the property back, and funds parked in lending protocols or exchange accounts are easier to reach than coins that have been dispersed across many addresses.
6. What the Case Means for Evidence Handling
The plea statement says Yaroch's conduct compromised several FBI investigations into criminal groups and nation-state adversaries. It also exposed sources and methods used in foreign intelligence collection, the techniques and informants that agencies guard most closely.
That consequence goes beyond the money. When an investigator drains a wallet that is under observation, the owner may notice and change behavior, and the movement of funds can reveal that someone is watching. A wallet created by the FBI as part of an operation is especially sensitive, because tampering with it can end the operation. The government's own description of the damage places the harm to investigations alongside the financial loss.
The episode highlights a long-standing challenge in digital asset enforcement. Seized crypto is a bearer asset, and the people who hold the keys have to be trusted or constrained by process. Common safeguards in custody generally include requiring more than one person to approve a transfer, keeping detailed logs of who touched which credentials, and regularly auditing balances against what the case file says should be there. The case does not describe which controls were in place or why they did not detect about 100 transfers, and the plea documents do not answer that question.
Observers of crypto crime often focus on outside attackers, such as state-linked hacking groups. This case is a reminder that insiders with legitimate access present a distinct risk, and one that technical defenses against outsiders do little to address.
7. What Happens Next?
Yaroch's sentencing is scheduled for March 4, 2027, in the federal court in Alexandria. The statutory maximum is 20 years in prison, though actual sentences under federal guidelines depend on factors the judge weighs, including the amount of loss, the offender's role and conduct after the offense, and any cooperation. His voluntary self-report and the recovery of about $925,000 are the kinds of facts that can be raised at sentencing, while the breach of trust attached to his position and the compromise of investigations point the other way.
Until then, the case remains a defendant's plea rather than a sentence. The government's statement of facts is now the agreed account of what he did, and it will form the basis for the court's decision. Any further details about how the thefts escaped notice for months, or what changes the bureau makes to how it stores seized credentials, would have to come from the Justice Department or the court record.