An FBI agent crypto theft case has produced a guilty plea in Alexandria, Virginia, with prosecutors alleging that a former counterintelligence officer converted bureau-held wallet credentials into personal profit. Patrick Steven Yaroch, 37, of Ashburn, Virginia, pleaded guilty on November 5, 2026, to wire fraud and money laundering, the U.S. Attorney’s Office for the Eastern District of Virginia said. U.S. District Judge Patricia Tolliver Giles accepted the plea.
The court papers put the illicit haul at approximately $2,474,380.66 in fraudulent proceeds. Prosecutors say Yaroch made approximately 100 fraudulent transfers using credentials related to 35 separate FBI investigations. The affected wallets were controlled by subjects of other investigations, by adversarial nation state actors, and included at least one wallet the FBI created for an operation. The scale of the case makes it more than an individual misuse of access. It shows how concentrated technical access inside a law enforcement agency can translate directly into the compromise of active investigations.
FBI agent crypto theft: Inside the bureau’s credential systems
According to the U.S. Attorney’s Office, from 2017 through early 2025, Yaroch worked at the FBI Boston Division on an investigative squad focused on an adversarial nation state. From February 2025 to July 31, 2026, he worked in the FBI’s Counterintelligence and Espionage Division. That second assignment gave him access to FBI systems containing cryptocurrency credentials collected during investigations.
Beginning no later than December 2024, Yaroch used that access to move coins from wallets into accounts he controlled. Once the assets moved, he exchanged them for different types of cryptocurrency. He then laundered the proceeds through additional financial transactions intended to obscure their source, nature and ownership. That layered process is why blockchain tracing teams must follow each transfer rather than simply identify the first wallet that received the funds.
Between November 25, 2025 and January 13, 2026, Yaroch transferred approximately $93,082 to one of his accounts. He then moved the funds among other accounts and sent payments to cover debts, including credit cards, car payments and other loans. For traders and compliance teams watching institutional custody risks, the case offers a specific warning. Credentials tied to investigative assets can remain operationally useful long after they are collected, so access governance matters as much as wallet encryption.
A much larger haul than first reported
The figure in the plea agreement is considerably larger than the earlier account. Charging papers filed in August described roughly $1 million in transfers, while the FBI seized $925,426.07 from Yaroch’s wallets after his arrest. The plea figure therefore more than doubles the amount described in those papers. Unchained reported that the plea totals equal about two and a half times the dollar figure and about 10 times the transfer count Yaroch gave the FBI in July.
Yaroch told agents he had made about 10 to 12 transfers worth under $1 million. That account was materially below the prosecution totals in the plea. The same affidavit, as reported by Unchained, said agents found he had moved about $1.02 million into a Suilend account around July 23 and made additional transfers after receiving the cryptocurrency. The announcement did not explain how the remaining difference was traced, so the full path of the funds is not yet publicly clear.
That gap is likely to matter at sentencing. Judge Giles will consider the U.S. Sentencing Guidelines and other statutory factors when imposing a sentence on March 4, 2027. Yaroch faces up to 20 years in prison. The disparity between his self-report and the agreed facts gives the court a measure of the scale of the conduct, while also leaving questions about concealment and cooperation that the final sentence may reflect.
Confession and the evidence at his home
Yaroch reported himself to two Justice Department employees on July 29, 2026. According to LCX, he broke down while speaking with a former colleague in the Justice Department’s National Security Division and said he had made very poor decisions involving cryptocurrency wallets. He then went to FBI headquarters, where he said he had become frustrated that the bureau could not or would not act against an adversary’s crypto accounts. He told officials he had decided to take matters into his own hands.
Agents searched his home two days later. They seized a Trezor hardware wallet, three passports and a slip of paper bearing seed phrases. His Kraken account held about $188,600, mostly in U.S. dollars and the USDC stablecoin, with smaller balances in Squid and Bitcoin. A further $933,800 sat in Suilend, a lending protocol on the Sui blockchain, which he accessed through the Slush wallet app.
Yaroch explained his choice of protocol by saying he liked the logo, which resembled a water droplet. Agents transferred about $925,000 from those accounts to government-controlled wallets, according to LCX. The roughly $165,600 held as U.S. dollars on Kraken could not be moved in the same way. That operational detail illustrates a recurring issue in digital-asset recovery. Crypto can move through a protocol in seconds, but cash held at a traditional exchange can sit outside the rapid transfer path until the institution responds.
Damage to investigations and sources
The agreed statement of facts describes consequences that extend beyond money lost to a single defendant. The U.S. Attorney’s Office said Yaroch’s conduct compromised multiple FBI investigations involving both criminal groups and nation state adversaries. It also compromised FBI sources and methods used in foreign intelligence collection and criminal investigations.
The statement further said his actions deprived FBI employees of their ability to carry out their functions to protect public safety and national security. That language is significant because it frames the harm as a loss of investigative capability, not merely the theft of funds. When an insider takes wallets connected to active cases, prosecutors may have to rebuild evidence, notify partners and reconsider techniques that were exposed from inside.
First Assistant U.S. Attorney Theophani K. Stamos and Daniel S. Wierzbicki, special agent in charge of the FBI Washington Field Office’s Counterintelligence Division, made the announcement. Assistant U.S. Attorneys Kathleen Robeson and Russell Carlberg are prosecuting the case, with assistance from the National Security Cyber Section of the Justice Department’s National Security Division and the DOJ inspector general’s Mid-Atlantic region. The case number is 1:26-CR-208 in the Eastern District of Virginia.
Plans for an overseas life
The plea papers also described Yaroch’s attempt to plan a new life abroad. He asked ChatGPT how to maximize investment returns and where to live in the European Union. After the chatbot suggested buying a vineyard in Portugal, he gave Portuguese lawyers power of attorney on June 15, 2026. The authority was meant to register him with the Portuguese Tax and Customs Authority, obtain a tax identification number and collect the password to his finance portal.
He then arranged travel to Portugal for September 2026. The sequence suggests an attempt to convert criminal proceeds into a legal identity and a plausible destination before his arrest on July 31, 2026. Unchained reported that he had initially been charged with interstate transportation and receipt of stolen goods. The later wire fraud and money laundering plea represents a broader legal characterization of the conduct described in court documents.
A wider pattern of insider crypto crime
The admission arrives as federal crypto-crime cases continue to accumulate. Bitcoin Magazine reported in October that former British National Crime Agency officer Paul Chowles was ordered to repay approximately $2.38 million after stealing 50 bitcoin seized during an investigation of the Silk Road 2.0 marketplace. Chowles had received a five-and-a-half-year prison sentence. That separate case involved a former law enforcement officer and assets already seized during an investigation, a similarity that places Yaroch’s plea within a broader insider-risk problem.
Bitcoin Magazine also cited FBI tallies placing United States crypto fraud losses above $11 billion in 2025, a figure the White House has used to frame a wider crackdown. That total concerns fraud reported to the bureau, not the conduct of its personnel, but the two trends overlap in an important way. Criminals target crypto assets, and trusted institutions hold the credentials and systems used to track them. Insider abuse exploits the infrastructure that enforcement depends on.
For market participants, the immediate concern is operational trust in the integrity of investigative credentials and exchange cooperation. The longer-term questions concern case repair and sentencing. March 4, 2027, is when Judge Giles addresses the first, while the public record leaves open how many of the 35 FBI investigations can be repaired after an insider treated the bureau’s own wallet credentials as a personal ATM. Until sentencing, the FBI agent crypto theft case leaves open what a plea cannot fix: which investigations are salvageable, and what a compromised credential chain costs the bureau’s credibility.