Patrick Steven Yaroch, a 37-year-old former FBI agent from Ashburn, Virginia, pleaded guilty on Thursday 5 November 2026 to wire fraud and money laundering for stealing about $2.47 million in cryptocurrency from wallets the bureau had gained access to in its own investigations. According to the release of the US Attorney’s Office for the Eastern District of Virginia, he made about 100 fraudulent transfers using credentials tied to 35 separate FBI investigations. US District Judge Patricia Tolliver Giles accepted the plea in Alexandria. Sentencing is set for 4 March 2027, and he faces up to 20 years in prison.
The figure is well above the first public account of this FBI agent cryptocurrency theft case. When Yaroch was arrested at the end of July, the charging papers described roughly $1 million moved in about 10 transfers, Decrypt reported at the time. The plea puts the proceeds at approximately $2,474,380.66, from about ten times as many transfers. Prosecutors have not said publicly how the larger figure was built.
In the words of the US Attorney’s Office, Yaroch “pled guilty today to wire fraud and money laundering related to using his access to steal cryptocurrency.” That access came from his job: an FBI system where the bureau kept the wallet credentials it gathered while investigating other people.
How the FBI agent cryptocurrency theft worked: 35 investigations, about 100 transfers
Yaroch joined the FBI’s Boston Division in 2017 and stayed there until early 2025, on a squad focused on what prosecutors call “an adversarial nation state”. The release does not name the country. In February 2025 he moved to the FBI’s Counterintelligence and Espionage Division, where he worked until 31 July 2026. That posting gave him access to FBI systems holding cryptocurrency credentials the bureau had collected during its investigations.
From no later than December 2024, according to the court documents summarised by the US Attorney’s Office, he used those credentials to take coins from three kinds of wallets: wallets controlled by the subjects of other investigations, wallets controlled by adversarial nation-state actors, and at least one wallet the FBI itself had created for an operation. Over the life of the scheme that came to about 100 transfers.
Laundering came next. After moving the stolen coins, he swapped them into a different cryptocurrency, then pushed them through further transactions to hide where they came from. Between 25 November 2025 and 13 January 2026, he sent about $93,082 to one of his accounts, moved the money between other accounts and used it for his debts: credit cards, car payments and other loans.
Paying off debts was not the whole plan. The release says he asked ChatGPT how to get the most out of investments and where to live in the European Union. After the chatbot suggested a vineyard in Portugal, he signed a power of attorney on 15 June 2026 so that Portuguese lawyers could represent him before the country’s Tax and Customs Authority, register him, obtain his tax number and collect the password to his finance portal. He then arranged a trip to Portugal for September 2026. Decrypt’s August report adds that he told agents he was not planning to move money into Portugal.
From $1 million to $2.47 million: what the filings show, and what they do not
The first account of the case came from the criminal complaint filed after his arrest on 31 July 2026. Decrypt reported on 3 August that the complaint charged him with interstate transportation of stolen goods and receipt of stolen goods, and described about $1 million moved in about 10 transfers between early 2025 and July 2026. That $1 million was Yaroch’s own account to investigators, according to Decrypt. The complaint also said he held a Top Secret clearance, had memorised seed phrases obtained from FBI systems and created his own wallet to receive the coins.
Nothing in the public record shows that an internal alert caught him. According to Decrypt’s August report, he contacted a Justice Department employee on the messaging app Signal on 28 July and asked to meet about “personal matters”; at FBI headquarters, prosecutors wrote, he “immediately started to break down as he told his story”. Decrypt’s report on the plea describes the same episode as a self-report: on 29 July he told a former colleague at the Justice Department’s National Security Division about “very poor decisions” involving crypto wallets, then reported himself to FBI headquarters.
Decrypt also reports the motive he gave: frustration that the bureau “could not or would not act” against an adversary’s crypto accounts. That is his own account, and the plea release does not repeat it. He told investigators he had made 10 to 12 transfers worth under $1 million, far below the figures in the plea.
Searching his home two days after the confession, agents seized a Trezor hardware wallet, three passports and a slip of paper with seed phrases, according to Decrypt. Decrypt also lists a Kraken account worth about $188,600, mostly in US dollars and USDC, and about $933,800 held on Suilend, a lending protocol on the Sui network, reached through the Slush wallet app.
| Figure | Amount | Source |
|---|---|---|
| Proceeds in the plea | about $2,474,380.66 | DOJ release, 5 Nov 2026 |
| Transfers in the plea | about 100, from 35 investigations | DOJ release |
| Laundered to pay debts (25 Nov 2025 to 13 Jan 2026) | about $93,082 | DOJ release |
| Amount in the August complaint | about $1 million, about 10 transfers | Decrypt, 3 Aug 2026 |
| Kraken account seized | about $188,600 | Decrypt, from the August filings |
| Held on Suilend (Sui) | about $933,800 | Decrypt, from the August filings |
| Moved to government-controlled wallets | about $925,000 | Decrypt, from the August filings |
| US dollars on Kraken not moved that way | about $165,600 | Decrypt, from the August filings |
According to Decrypt, agents moved about $925,000 from those accounts to government-controlled wallets. The roughly $165,600 held as US dollars on Kraken could not be moved the same way. Those are second-hand figures from the August filings; none of them appears in the plea release.
The sources do not fully explain the gap. The two counts do not measure the same thing: the August figure rested on what Yaroch told agents about roughly 10 transfers, while the plea covers about 100 transfers listed in the court documents. How each transfer was valued, at the price on the day of the theft or later, is not stated. Also unknown: whether the $925,000 already moved counts toward any restitution, which chains and tokens beyond Sui and Kraken were involved, what kind of wallet the FBI had set up for its operation, and which addresses were used. No on-chain address has been published.
Prosecutors say FBI sources and methods were compromised
Prosecutors describe damage that goes beyond the money. In the agreed statement of facts, Yaroch accepts that his actions compromised several FBI investigations into both criminal groups and nation-state adversaries, and kept FBI employees from doing their work on public safety and national security.
According to the same release, his conduct also “compromised FBI sources and methods used in foreign intelligence collection and criminal investigations.” Emptying a target’s wallet can tell that target the wallet was watched, and that someone held its keys. The release gives no detail on which operations were affected.
The case was announced by Theophani K. Stamos, First Assistant US Attorney for the Eastern District of Virginia, and Daniel S. Wierzbicki, Special Agent in Charge of the counterintelligence division of the FBI Washington Field Office. The Justice Department’s National Security Cyber Section and its Office of the Inspector General, Mid-Atlantic Region, assisted. The case number is 1:26-CR-208.
How US agencies hold seized crypto, and where this case breaks
Seized or collected crypto is not a pile of cash in an evidence room. Whoever holds the private key or the seed phrase of a wallet can move what is in it, from anywhere, without touching any physical object. An investigator who obtains a suspect’s recovery phrase holds the same power as the suspect. Our guide to seed phrase security explains why that string of words is the wallet itself.
The FBI system Yaroch could reach held credentials, and according to the August complaint as reported by Decrypt, he memorised seed phrases and rebuilt the wallets on his own device. The public record does not show any second approval or alert: the release does not say whether a second person had to approve a transfer, whether access was logged, or whether any internal control flagged the movements between December 2024 and July 2026. As far as Decrypt’s reports on the filings show, the scheme came to light because he reported himself.
Custody designs exist to stop one insider from acting alone. A multisig wallet needs several signatures before funds move. Key-splitting services, such as the multi-party computation offering Google previewed for banks in October, spread a key across several parties so none of them holds it whole. Whether the FBI uses either for coins it collects is not public, and nothing in this case shows the bureau has changed its rules.
Forfeited assets are a separate step. Once a court orders forfeiture, coins can pass to the US Marshals Service, which also relies on contractors. That chain has been tested too: Decrypt reported on 5 March 2026 that John Daghita, son of the president of CMDSS, a firm that held a Marshals Service contract, had been arrested on Saint Martin in a joint operation of the FBI and the French gendarmerie. The blockchain investigator ZachXBT had accused him in January of taking about $46 million of crypto held by the Marshals Service. Those are allegations, and Daghita is not described as a federal agent.
Earlier cases: Silk Road agents and a Secret Service vault
Yaroch is not the first federal agent to take crypto that passed through an investigation. In the Silk Road case, former Drug Enforcement Administration agent Carl Force pleaded guilty to extortion, money laundering and obstruction and was sentenced in October 2015 to six and a half years. Former Secret Service agent Shaun Bridges, who took about $350,000 in bitcoin from Silk Road accounts in January 2013, received five years and 11 months in December 2015, CBS San Francisco reported. Both were sentenced by US District Judge Richard Seeborg.
A smaller case is closer to this one in method. Anthony Joseph Evans, a Secret Service special agent in Phoenix, accessed crypto on a hardware wallet held in the agency’s evidence vault in early 2022 and moved about $56,000 to two wallets he controlled, according to the US Attorney’s Office for Arizona. He pleaded guilty in December 2024 to converting property of another as a federal employee. His plea deal capped his exposure at a year and a day in prison and required restitution, including any rise in the coins’ value before sentencing.
The Yaroch case differs in scale. Evans reached one hardware wallet kept in a vault; Yaroch reached credentials from 35 investigations, national-security cases among them, through a bureau computer system, over at least 19 months.
What happens next: sentencing on 4 March 2027
Yaroch is due to be sentenced on 4 March 2027. He faces up to 20 years in prison. The sentence is for the judge to set, after weighing the US Sentencing Guidelines and other statutory factors, and the release gives no indication of what prosecutors will ask for.
No restitution or forfeiture amount appears in the release, and the terms of the plea agreement are not public. It does not say whether he is cooperating. No statement from the FBI on its custody procedures, and no review announced by Congress or the Justice Department inspector general beyond its help on the case, had been found by Coindaro by 18:00 UTC on 6 November.
The same question applies to anyone holding coins: who else can reach the keys. Exchange accounts like the Kraken account seized here sit with a company that holds the keys for you, as our guide to how centralized exchanges work explains. This was an insider with legitimate access, a different kind of loss from the Binance hack that the FBI attributed to North Korea’s TraderTraitor group in October. The next public step is the sentencing hearing in Alexandria in March.