Former FBI Agent Admits Stealing $2.47 Million in Crypto From Investigative Wallets

A former FBI supervisory agent has pleaded guilty to wire fraud and money laundering after using access to investigative cryptocurrency credentials to steal approximately $2.47 million, the U.S. Department of Justice announced on November 5. The case highlights a security risk that is often overlooked in debates about stolen digital assets: improper access by a trusted insider.

How investigators say the thefts unfolded

Patrick Steven Yaroch, 37, of Ashburn, Virginia, worked in the FBI’s Counterintelligence and Espionage Division. According to the Justice Department, he used systems holding crypto credentials gathered during investigations to carry out approximately 100 fraudulent transfers involving material associated with 35 FBI cases.

The activity began no later than December 2024 and involved wallets connected to investigation subjects, adversarial nation-state actors and at least one wallet used for an FBI operation. Subsequent reporting on the court filings indicated that at least 79 wallets were affected, including some associated with crime victims.

Latest Stories

3 min read • 51 seconds ago

FinCEN Drops Proposed Crypto Travel Rule Expansion and Lower Transfer Threshold

3 min read • 56 seconds ago

Aave Labs Acquires Avon Team to Bring Fixed-Rate Loans Into DeFi

3 min read • 1 minute ago

FinCEN Cuts MEXC Global Off From U.S. Banking Over Alleged $16 Billion in Illicit Crypto Flows

Read all latest stories →

Prosecutors put the total fraudulent proceeds at approximately $2,474,380.66. They say Yaroch moved assets through multiple cryptocurrencies and transactions in an effort to disguise their source and control, then converted some proceeds into funds used to pay personal obligations. The department also said his conduct compromised investigations and affected the FBI’s ability to protect sources and investigative methods.

The Justice Department disclosed an unusual additional detail: Yaroch considered starting a new life in Europe and had sought advice on living abroad and investing the proceeds. Those personal plans are secondary to the security implications of privileged access to keys and wallet records.

Why the case matters for crypto custody

Digital-asset custody is frequently discussed in terms of malware, phishing and technical vulnerabilities. This case instead concerns an individual who allegedly already had access to sensitive information through legitimate employment. If signing credentials are exposed to personnel without sufficient separation of duties, strong cryptography alone does not prevent misuse.

Organizations holding crypto credentials can reduce this class of risk through narrowly scoped privileges, multisignature approval requirements, segregated production and evidence environments, tamper-resistant logs and independent transaction reviews. No single control is fail-safe, but combining them can make an unauthorized withdrawal harder to execute and easier to detect.

Yaroch is scheduled for sentencing on March 4, 2027 and faces a maximum statutory sentence of 20 years in prison, the department said. A guilty plea is not itself a completed sentencing process, and the judge will determine the actual penalty.

As cryptocurrency platforms confront their own custody and operational risks, the case provides a reminder that security is as much about procedures and accountability as software. TechGaged has also examined new models for separating custody from DeFi activity, where control boundaries are similarly central.

Sources: U.S. Justice Department, November 5; The Block, November 7.