FBI Agent Admits Stealing $2.5M in Crypto From Suspects' Wallets

A former FBI counterintelligence agent has pleaded guilty to wire fraud and money laundering after stealing nearly $2.5 million in cryptocurrency from wallets belonging to fraud victims and nation-state hackers under his own bureau's investigation. The figure is exact: $2,474,380.66, according to the Justice Department.

Patrick Steven Yaroch, 37, admitted the thefts on Thursday in a US federal court. The case is not a hacking story in the usual sense. It is an insider-abuse story. The credentials came from the FBI itself.

How did he get access to the wallets?

Yaroch worked on a national security investigative squad at the FBI Boston Division from 2017 to 2025. He then served as a supervisory special agent in the FBI Headquarters Counterintelligence and Espionage Division from February 2025 to July 2026. That career arc matters. He rose in rank while the scheme ran.

According to court documents, Yaroch pulled cryptocurrency wallet passphrases from the FBI's case management systems and from another platform used to share investigative data. He used those passphrases to move funds from wallets of fraud victims and suspects into his own wallets. After each transfer, he exchanged the stolen cryptocurrency for other cryptocurrencies to obscure the trail.

The scale, in the DOJ's own words: "Throughout his wire fraud scheme, Yaroch conducted approximately 100 fraudulent transfers using credentials related to 35 separate FBI investigations. He illicitly gained approximately $2,474,380.66 in fraudulent proceeds."

One hundred transfers across 35 investigations. That is roughly three wallet-draining operations per compromised case, sustained over an extended period without internal detection. The DOJ has not said how long the scheme ran before Yaroch self-reported, nor has it explained why case-management passphrase access went unaudited. Those gaps deserve attention.

What did he do with the money?

The court filings trace a concrete spending pattern. Between November 25, 2025, and January 13, 2026, Yaroch moved approximately $93,082 into one of his accounts. He then shuffled the funds between his own accounts and sent payments to cover personal debts: credit cards, car payments, and other loans.

That is roughly $1,500 per day over the seven-week window. Debt service, not extravagance, appears to be the driver. The filings do not state the total volume of debt he carried.

Why did the case surface now?

The scheme ended only because Yaroch ended it. He self-reported the crypto theft to DOJ National Security Division and FBI Headquarters employees on July 29. The FBI placed him on administrative leave the same day and fired him on July 31, 2026. Police arrested him at his residence on July 31.

Self-reporting cut short the crime. It did not soften the charges. Prosecutors still pursued and secured guilty pleas on both counts.

Was he planning to flee?

Court documents suggest he was preparing an exit. Yaroch booked flight tickets to Lisbon for early September for himself and his family. He had granted power of attorney to two lawyers in Portugal to obtain a tax identification number on his behalf.

His destination research came from ChatGPT. Prosecutors quoted his prompt directly: "If you had a bucket of money (around $1 million) and you wanted to leave the USA and become a resident or citizen of an EU country, what would you do?"

The chatbot's reply, also quoted in filings, noted: "At 37, with a young family, a goal of potentially retiring around 40, and a clear interest in eventually building a slower-living vineyard/agricultural lifestyle in places like Cilento or Portugal's Dão region…" The model answered a lifestyle question. It did not ask where the million dollars came from.

What is the damage beyond the money?

Prosecutors stated the obvious institutional cost. Yaroch's actions compromised multiple FBI investigations involving nation-state adversaries and criminal groups. They also exposed FBI sources and methods used in criminal investigations and foreign intelligence collection.

Draining a suspect's wallet alerts that suspect. The compartment of each of those 35 investigations is now burned or in question. No figure has been put on that intelligence damage, and none may be possible.

What happens next?

Sentencing is scheduled for March 4. The wire fraud charge carries up to 20 years in prison. The money laundering charge carries another maximum of 20 years. Whether the sentences run consecutively is for the court.

For security leaders, the lessons are blunt. Privileged access to investigative data platforms went unchecked long enough for roughly 100 fraudulent transfers. Insider threat monitoring failed to catch a supervisory agent monetizing case files. The breach was closed by confession, not by controls.