Ex-FBI agent pleads guilty to stealing $2.47 million in crypto from wallets tied to 35 investigations

Former FBI agent Patrick Steven Yaroch admitted on Thursday to stealing about $2.47 million in cryptocurrency from wallets tied to FBI investigations, according to the U.S. Attorney's Office for the Eastern District of Virginia.

Yaroch, 37, of Ashburn, Virginia, pleaded guilty to one count each of wire fraud and money laundering related to the thefts. Each count carries up to 20 years in prison, and sentencing is set for March 4, 2027.

From 81 cents to $580,000

Beginning no later than December 2024, Yaroch searched FBI databases, including a classified one, for crypto credentials, according to the statement of facts he signed. He used the information he found to make about 100 transfers out of at least 79 wallets connected to 35 FBI investigations.

Most of the wallets belonged to people under FBI investigation, and some were controlled by two adversarial nation states the filing does not name. NBC News reported in August, citing two sources, that the adversarial nation in the original complaint was Russia. Yaroch also made at least 10 transfers from wallets belonging to crime victims in other FBI cases, and at least one from a wallet the FBI had funded for an operation.

The filing calls Yaroch "indiscriminate," with individual thefts ranging from 81 cents to more than $580,000. After each theft, he kept checking FBI systems to make sure no one had noticed.

Yaroch joined the FBI's Boston Division in 2017, working on a squad focused on one of the two nation states. From February 2025 until July 31, 2026, he was a supervisory special agent in the Counterintelligence and Espionage Division at FBI headquarters.

Monero, Sui and a Lexus

Yaroch had racked up significant debts before the scheme began: he had taken out more than $100,000 in loans in 2024 and owed more than $45,000 on credit cards, according to the filing. 

In one example from the filing, Yaroch used credentials from a criminal case file on Nov. 6, 2025, to empty two wallets into his own bitcoin wallet. Over the following weeks, he ran the BTC through a swap service with privacy features, converted some of it to Monero (XMR) and then Solana (SOL), and moved the funds through a Sui wallet to his Kraken account.

Between Nov. 25, 2025, and Jan. 13, 2026, Yaroch moved about $93,082 to a TD Bank account and used it to pay down debts, including about $30,176 on credit cards and $20,000 toward a Lexus, per the filing. Yaroch initially said he stole the crypto out of frustration, but prosecutors wrote in an August court filing that he "should not be viewed as a selfless Robin Hoodesque figure."

'Age-worthy red wine'

On June 4, Yaroch asked ChatGPT what it would do with about $1 million if it wanted to leave the U.S. and live in a European Union country. The chatbot's answer cited his wife and child, "the desire for a 2-5 hectare estate, interest in age-worthy red wine," and named Portugal "my top choice for your specific situation," according to the filing.

On June 15, Yaroch gave two Portuguese lawyers power of attorney to register him with the country's tax authority. He also arranged a September trip to Portugal tied to his planned vineyard purchase. Prosecutors also said in the August filing that Yaroch had failed to report a 10-day trip in May, when he flew to Germany and came home from Portugal.

The prosecutors asked to keep him jailed before trial, citing about $160,000 he still held on Kraken and possible Espionage Act charges that were never filed. U.S. District Judge Anthony Trenga instead released him on a $50,000 bond with location monitoring, under conditions that bar him from using video game consoles.

The seed phrase

Yaroch initially agreed to give agents a piece of paper that appeared to contain his seed phrase, according to the August filing. However, he later asked for it back after agents told him he had the right to stay silent and that what he said could be used against him in a criminal case.

When agents found the wallet he had pointed them to, $1.02 million had already moved out. Yaroch then admitted the funds were on the lending platform Suilend and helped them reinstall a wallet app he had deleted from his phone.

Restitution and forfeiture

Under the plea agreement, Yaroch must pay at least $2.4 million in restitution and faces a forfeiture judgment of at least $2.4 million. He also agreed to forfeit 17,990.67 USDC and about 1.38 million SUI seized on July 31, worth roughly $1.2 million at current prices, plus the contents of his TD Bank, Charles Schwab, Kraken and BloFin accounts.

Yaroch acknowledged that the full proceeds of the scheme "are not available." He also agreed to be interviewed by Justice Department and FBI officials about his crimes.

If there's eventually a Netflix documentary about the case, Yaroch won't be profiting: any money he makes from books, films, articles or interviews about his FBI work or his case will go to the U.S. government. He must also submit any such work to the FBI for review before publication.

The August charges

The Block reported in August that Yaroch had been fired on July 31 and charged with transporting and receiving stolen money. At the time, the Justice Department's Office of the Inspector General said he had moved about $1 million in roughly 10 transfers and had reported himself to two Justice Department employees on July 29.

Earlier this year, the FBI arrested John Daghita in Saint Martin over the alleged theft of more than $46 million in crypto from the U.S. Marshals Service. Onchain investigator ZachXBT alleged that Daghita is the son of an executive at a firm contracted to help the agency manage seized crypto.

A federal grand jury in Alexandria indicted Daghita on 15 counts in March, and a French appeals court in Guadeloupe approved his extradition to the U.S. in May, according to local broadcaster RCI. His arraignment is set for Nov. 12 in Alexandria, according to his court docket.