A former supervisory special agent with the Federal Bureau of Investigation has pleaded guilty to wire fraud and money laundering after siphoning nearly $2.5 million in cryptocurrency from wallets tied to active federal cases. The stolen funds belonged to both fraud victims and cybercriminal suspects, including nation-state hackers under active investigation.

Patrick Steven Yaroch, 37, admitted in court that he abused his authorized access to sensitive internal systems to harvest wallet passphrases. According to reporting by BleepingComputer, Yaroch served on a national security investigative squad at the FBI Boston Division from 2017 to 2025 before becoming a supervisory special agent in the Counterintelligence and Espionage Division at FBI Headquarters from February 2025 to July 2026.

Abuse of Investigative Databases and Case Files

Court filings show that Yaroch obtained passphrases and private credentials stored within the FBI's internal case management systems as well as a secondary platform designed for sharing investigative data across squads. Using these credentials, Yaroch executed unauthorized transactions directly from target cryptocurrency wallets into addresses under his personal control.

After transferring the assets, Yaroch attempted to obscure the transaction trail by exchanging the stolen assets for alternative cryptocurrencies. In total, Yaroch executed roughly 100 fraudulent transfers linked to 35 separate FBI investigations, netting approximately $2,474,380.66 in illicit proceeds.

Federal prosecutors stated that between November 25, 2025, and January 13, 2026, Yaroch shifted approximately $93,082 into one of his accounts. From there, he dispersed funds across other personal accounts to pay down personal liabilities, including vehicle payments, credit card balances, and other loans.

Compromised Intelligence and Escape Plans

Beyond the direct financial losses, the Department of Justice noted that Yaroch's scheme caused severe operational damage. His unauthorized access and asset manipulation compromised multiple sensitive FBI investigations targeting nation-state threat actors and cybercrime syndicates. The breach also exposed confidential FBI sources and investigative methods relied upon for criminal prosecutions and foreign intelligence collection.

Investigators also discovered that Yaroch had been planning an overseas relocation. After querying the AI model ChatGPT regarding how to relocate to the European Union with approximately $1 million to establish a vineyard or agricultural lifestyle, Yaroch purchased flights to Lisbon, Portugal, for his family. He had also granted power of attorney to two Portuguese attorneys to secure local tax identification numbers.

The scheme ended when Yaroch self-reported the crypto thefts to employees within the DOJ National Security Division and FBI Headquarters on July 29, 2026. The agency placed him on administrative leave the same day, formally dismissed him on July 31, and arrested him at his residence that afternoon.

Yaroch pleaded guilty to one count of wire fraud and one count of money laundering. He is scheduled to be sentenced on March 4, where he faces a statutory maximum penalty of 20 years in prison for the wire fraud charge and up to 20 years for money laundering.

Defending Against Insider Abuse and Credential Theft

The incident highlights the acute risk of insider threats when sensitive cryptographic secrets and evidentiary assets are accessible across enterprise databases without sufficient safeguards. Security and IT teams managing evidentiary, financial, or sensitive data environments should take clear defensive steps:

  • Enforce strict least-privilege access: Case files, evidentiary databases, and private cryptographic keys should never be globally visible to investigators or personnel who do not have an active, verified operational need.
  • Implement split-key custody and multi-party computation: Cryptographic passphrases, seed phrases, and private keys should never be stored in plaintext within case-tracking software. High-value digital assets require multi-signature approval or hardware security modules (HSMs) to authorize transactions.
  • Deploy anomalous data access monitoring: Implement behavioral auditing on investigative and case management platforms to flag personnel viewing credentials or sensitive data outside their assigned caseload.
  • Maintain unalterable audit trails: All queries, read requests, and exports involving sensitive evidentiary material must be logged to tamper-resistant, centralized security information systems for routine review.