FBI agent drains crypto wallets tied to 35 investigations, steals $2.47 million and plans Portugal escape

A former FBI agent stole $2.47 million in crypto using classified investigative records, compromising federal investigations into criminal organizations and foreign adversaries.

The US Department of Justice disclosed on Nov. 5 that Patrick Steven Yaroch, 37, pleaded guilty to wire fraud and money laundering after exploiting his access to crypto wallet credentials collected during FBI investigations.

His scheme involved about 100 unauthorized transfers using credentials tied to 35 separate FBI investigations, including wallets belonging to suspected criminals, adversarial nation-state actors, and at least one wallet the bureau created for an operation.

Prosecutors said the thefts compromised multiple investigations involving criminal groups and foreign adversaries, along with sensitive intelligence-gathering methods.

The disclosure exposes a significant internal security failure at the FBI, where an agent entrusted with protecting national security turned information gathered through federal investigations into personal enrichment.

According to prosecutors, Yaroch worked in the FBI's Boston Division from 2017 until early 2025, investigating threats involving a foreign adversary.

He subsequently joined the bureau's Counterintelligence and Espionage Division, where he had access to systems containing cryptocurrency credentials obtained through investigations.

The thefts began no later than December 2024, before his transfer to the division.

An FBI affidavit filed in August revealed that Yaroch searched bureau records for crypto wallets associated with foreign adversaries, memorized their recovery credentials, and transferred funds into a personal wallet.

Investigative access to wallet credentials enabled personal transfers, including from at least one FBI operational wallet.

The affidavit's personal-wallet account predates the broader plea scope. The total proceeds and transfer count describe the entire scheme, not a single wallet balance. The diagram does not identify affected cases, all destinations, security controls or a network breach.

Sources and evidence

Sources

1. DOJ plea announcement, Nov. 5, 2026
2. FBI affidavit, Aug. 1, 2026

Supporting facts

• According to court documents described by DOJ, Yaroch worked in the FBI's Counterintelligence and Espionage Division from February 2025 through July 31, 2026, with access to systems containing cryptocurrency credentials collected during investigations. [1]
• DOJ said Yaroch began stealing cryptocurrency no later than December 2024 from wallets controlled by investigation subjects or adversarial nation-state actors, and from at least one wallet created by the FBI for an operation. [1]
• DOJ said Yaroch conducted approximately 100 fraudulent transfers using credentials related to 35 separate FBI investigations and illicitly gained approximately $2,474,380.66. [1]
• An FBI affidavit filed Aug. 1, 2026, recounts Yaroch telling FBI personnel that he searched FBI holdings, memorized wallet credentials and used them to transfer cryptocurrency to a personal wallet. [2]
• The FBI agent's affidavit explains that a seed phrase unlocks a cryptocurrency wallet and distinguishes it from an additional passphrase. [2]

Method

Schematic maps the credential-access account in the Aug. 1 affidavit onto the broader wallet categories and approximate scheme totals in DOJ's Nov. 5 plea announcement. Connector sizes are not quantitative. $2.47M is the rounded reported proceeds total; no new arithmetic.

Scope

The affidavit's personal-wallet account predates the broader plea scope. The total proceeds and transfer count describe the entire scheme, not a single wallet balance. The diagram does not identify affected cases, all destinations, security controls or a network breach.

Infographic by CryptoSlate

He initially told investigators that frustration with the FBI's inability to disrupt certain adversarial crypto accounts had led him to take matters into his own hands.

However, the misconduct expanded into a broader theft and money laundering scheme.

After taking the crypto, Yaroch converted portions into other digital assets and moved funds through additional transactions to conceal their origins.

Between November 2025 and January 2026, he transferred approximately $93,082 into an account and used money moved between his accounts to cover credit card bills, vehicle payments, and other debts.

The Justice Department said his actions interfered with the FBI's ability to protect public safety and national security while compromising sources and methods used in criminal investigations and foreign intelligence collection.

Prosecutors did not identify the affected countries or investigations, leaving the full extent of the intelligence damage undisclosed.

Stolen FBI crypto funds fuel plans for a new life in Portugal

Beyond paying personal debts, Yaroch was preparing to use the proceeds to establish a new life in Europe, according to federal investigators.

Court documents revealed that the former agent turned to ChatGPT for advice on investing approximately $1 million and relocating to the European Union.

After discussing his interest in vineyard ownership and a slower lifestyle, the AI chatbot recommended Portugal as a potential destination.

Yaroch subsequently took concrete steps toward establishing himself in the country.

On June 15, he granted power of attorney to Portuguese lawyers to register him with the country's tax authorities and obtain a tax identification number.

Investigators also discovered plans for a September trip to Portugal. The August affidavit disclosed that Yaroch had previously traveled abroad without reporting some of those trips to the FBI, despite security requirements.

His plans unraveled in July when he voluntarily disclosed his cryptocurrency thefts to Justice Department personnel.

The initial investigation identified roughly $1 million in suspected stolen cryptocurrency. However, the subsequent criminal case found that the scheme generated about $2.47 million.

The FBI terminated his employment on July 31, and investigators recovered approximately $925,426 in cryptocurrency from accounts he controlled that day. An additional $165,582 remained in dollars at Kraken, according to the affidavit.

Yaroch is scheduled to be sentenced on March 4, 2027, and faces up to 20 years in prison.