An FBI Agent Stole $2.47M in Crypto From 35 Investigations — 5 Checks That Keep Your Coins Safe From Insider Theft

An FBI agent with Top Secret clearance stole $2.47 million in cryptocurrency — not by hacking anything, but by memorizing the seed phrases he was supposed to be investigating. Patrick Steven Yaroch, 37, pleaded guilty on November 5, 2026, to wire fraud and money laundering after making roughly 100 fraudulent transfers from wallets tied to 35 separate FBI investigations. He faces up to 20 years in prison when he is sentenced on March 4, 2027.

The case is a warning that reaches far beyond one rogue agent. In crypto, whoever holds the seed phrase holds the money. There is no password reset, no fraud department, and no chargeback. And the person holding the phrase might be someone you trusted completely — even the person whose job is to catch the thieves.

What the FBI agent actually did

Yaroch was a supervisory special agent who worked in the FBI's Boston Division from 2017 to early 2025, then moved to the Counterintelligence and Espionage Division in February 2025, where he stayed until July 2026. He held Top Secret clearance, which gave him access to FBI systems that stored cryptocurrency credentials collected during investigations.

According to the U.S. Department of Justice, Yaroch used that access to drain wallets belonging to three kinds of owners: subjects of FBI investigations, adversarial nation-state actors, and — in one case — an FBI operational wallet. The plea puts the fraudulent proceeds at approximately $2.47 million, moved through about 100 transfers tied to 35 separate investigations. Court documents say he then exchanged the funds for a different type of cryptocurrency and laundered them through a chain of financial transactions. Some of the stolen crypto was deposited into the Suilend lending platform to earn yield.

One detail matters for understanding the case correctly. Most of the wallets Yaroch raided were not coins sitting in government custody. They were wallets the FBI held credentials for because of its investigations. Only the operational wallet actually belonged to the bureau. That distinction is important — and it is also what makes the case so unsettling for ordinary holders. The coins were not seized property in a vault. They were live wallets whose keys sat in an internal system, visible to an employee who decided to spend them.

His method was strikingly simple. According to an August 1 court affidavit, Yaroch told investigators he searched FBI holdings, memorized wallet passphrases, and transferred the funds to a wallet of his own. A memorized passphrase was enough because of how crypto wallets work. An address tells you where funds sit, but it cannot authorize a payment. A usable passphrase can — and it works for whoever holds it, whether or not that person has any legal right to the assets. Once an investigator can view the secret, examining the evidence and spending the money require exactly the same access.

The timeline: from first theft to guilty plea

The scheme ran for about a year and a half before it ended. Here is how it unfolded, according to court filings and the Justice Department:

• December 2024 — the thefts begin. Yaroch starts using his position to steal cryptocurrency from wallets tied to FBI investigations.
• Late 2024 to early 2025 — the first 10 transfers. An earlier court filing records 10 unauthorized transfers in this period, worth roughly $1 million in digital assets.
• November 2025 to January 2026 — the money moves. Yaroch transfers nearly $93,082 to one of his own accounts, then shuffles the funds between other accounts, according to court documents.
• May 2026 — the Portugal plan. Yaroch asks ChatGPT how to maximize his investments and where to live in Europe. After ChatGPT suggests buying a vineyard in Portugal, he takes steps to register with the Portuguese Tax and Customs Authority, obtains a tax identification number, and makes arrangements to travel to Portugal in September 2026.
• July 31, 2026 — confession and arrest. Yaroch confesses to a Department of Justice employee, citing feelings of guilt. He is summarily dismissed from the FBI and arrested the same day. Investigators move approximately $925,400 from Yaroch-controlled accounts into government-controlled crypto wallets. About $165,600 in U.S. dollars remains in his Kraken account. Devices, seed phrases, and a Trezor hardware wallet are recovered.
• November 5, 2026 — guilty plea. Yaroch pleads guilty to wire fraud and money laundering in U.S. District Court in Alexandria, Virginia, before Judge Patricia Tolliver Giles.
• March 4, 2027 — sentencing. The hearing is scheduled, and Yaroch faces up to 20 years in prison. It should also produce the first final accounting of the stolen assets through a forfeiture or restitution figure.

What was recovered — and what was not

The recovery numbers look encouraging at first glance: about $925,400 was moved into government wallets on July 31, before the affidavit was even filed, and another $165,600 sat in his Kraken account. But those are observations from a single date. The November plea announcement gives no updated recovery total, so subtracting the July figure from the $2.47 million plea figure would not show what is still missing — particularly after asset conversions and months of changing crypto prices.

There is also a loss no recovery can cover. The Justice Department says Yaroch compromised investigations, sources, and methods. It does not identify the affected cases or estimate the operational damage. Returning the crypto can reduce the financial loss. It cannot show whether a compromised investigation remains viable, or whether exposed sources and methods can still be relied on. That is the part of the case that will not be fixed by a restitution order.

It is also worth noting what the public record does not say: how the theft was detected, or how long it ran before anyone noticed. The seizure shows funds were frozen before the case was resolved — not that monitoring caught the transfers early. In fact, the scheme appears to have ended because Yaroch confessed, not because a control flagged it.

This is not the first time: the insider-theft pattern

Yaroch is not an anomaly. Federal agents stealing crypto from the cases they work on is a pattern that goes back to the earliest days of Bitcoin law enforcement:

Case	Who	Year	Amount	Outcome
FBI crypto theft	Patrick Yaroch, FBI supervisory agent	2024–2026	~$2.47 million	Guilty plea; up to 20 years (sentencing March 2027)
Silk Road extortion	Carl M. Force, DEA special agent	2015	~$700,000 in Bitcoin	Guilty plea; 6.5 years in prison
Silk Road theft	Shaun W. Bridges, Secret Service special agent	2015	~$350,000 in Bitcoin	Guilty plea; 6 years in prison
Silk Road 2.0 case	UK National Crime Agency officer	Reported earlier	Bitcoin from a seized investigation	Prosecuted for stealing investigation funds

The pattern repeats because the vulnerability is structural, not personal. Every one of these cases has the same shape: one person with legitimate access to a seed phrase or private key decides to use it. No firewall stops that. No password policy stops that. The only thing that stops it is a system designed so that no single person can see — and use — the full secret alone.

That is exactly the standard the National Institute of Standards and Technology describes as least privilege: limit access to what a person needs for their assigned work. And dual authorization: require at least two authorized people to access certain resources. For wallet secrets, both principles govern who can reveal, copy, or use the credential itself. A second approval inside an internal payment workflow protects very little if one employee can retrieve the full credentials and move funds outside that workflow — which matches the route Yaroch described to investigators.

What most people get wrong about crypto safety

The Yaroch case breaks four assumptions that most crypto holders still carry around. Each one is worth correcting, because each one is a hole in how people actually store their money.

Myth 1: "My coins are safe because I trust the institution holding them." Trust is not a security control. The FBI is one of the most vetted institutions on earth, and an insider still walked out with $2.47 million. An exchange, a custodian, a fund, or an agency is a group of people — and any one of them can be the weak link. If someone else holds your keys, your safety depends on their hiring, their monitoring, and their honesty. That is a bet, not a guarantee. For a reminder of how often custodians fail, read our guide to the FBI's shutdown of 241 crypto scam websites and the Crédit Mutuel Arkéa hack, where $133 million moved through crypto exchanges.

Myth 2: "A seed phrase is like a password — it can be reset." It cannot. A password belongs to an account run by a company that can issue a new one. A seed phrase is the money itself. Whoever memorizes it, photographs it, or copies it can spend the funds from anywhere in the world, with no company to call and no reversal. Yaroch did not need to break into anything. He needed to remember 12 or 24 words.

Myth 3: "Only hackers steal crypto." Hackers steal plenty — the FBI named North Korea in the $6.3 billion Binance hack just this month. But insiders steal too, and insider theft is harder to detect because the thief already has legitimate access. The transfers look normal until someone checks. In Yaroch's case, roughly 100 transfers across 35 investigations went unnoticed for over a year.

Myth 4: "If my crypto is stolen, the police will get it back." Sometimes — here, about $925,400 was recovered, largely because the thief confessed and cooperated. But most crypto thefts are never recovered at all. Blockchain transactions are irreversible, stolen funds are laundered through mixers and chain-hops within minutes, and cross-border cases can take years. Recovery is the exception. Prevention is the only reliable strategy.

The 5 checks that keep your coins safe from insider theft

You cannot control how the FBI stores its evidence wallets. You can control how your own coins are stored. These five checks apply the same principles — least privilege and dual authorization — to a single holder:

• Keep your seed phrase offline and completely private. Never photograph it, never type it into a website, never paste it into a chat, and never read it out to anyone claiming to be support staff. Anyone who sees the phrase can spend the funds. If you want to compare storage options, start with our guide to the best crypto wallets in 2026.
• Use a hardware wallet for any meaningful holding. A hardware wallet keeps your private keys on the device, so they never touch an internet-connected computer. Even if your laptop is compromised, the keys stay put. Our beginner comparison of hot vs cold wallets explains the trade-offs in plain language.
• Back up the phrase on metal, stored separately from the device. Paper burns, fades, and gets thrown away. A stamped steel plate survives fire and flood. Keep the backup in a different physical location from the wallet itself, so a single burglary or disaster cannot take both.
• Split control so no single person can move the funds alone. A multisignature wallet — for example, 2-of-3 keys — means one compromised key, one coerced person, or one rogue insider cannot drain the wallet. This is the personal version of the dual-authorization control that institutions are supposed to use, and it is the single most effective defense against insider theft.
• Treat every custodian as a risk, including the reputable ones. Exchanges get hacked, agencies get infiltrated, and employees go rogue. Keep only trading funds on an exchange, verify proof of reserves where it exists, withdraw the rest to self-custody, and assume any third party holding your keys can fail. If you are still choosing where to buy, our guide to buying Bitcoin in the UK shows how to compare regulated platforms on fees and safety.

Why this case matters right now

2026 has been the year custodial risk stopped being theoretical. The $6.3 billion Binance hack in October, the $133 million Arkéa theft, and now an FBI insider draining investigation wallets — three different kinds of custodian, three different failures, one lesson: whoever holds the keys holds the money, and keys change hands more easily than most people think.

The timing adds pressure. Bitcoin fell below $76,000 on November 5–6, down about 5.8% in a day as the Nasdaq dropped 5.52% on fears about AI valuations, and Ethereum fell more than 8% to around $2,240. Fear makes people move coins — to exchanges, to new wallets, to "safer" places — and movement is exactly when mistakes happen: a seed phrase typed into a phishing site during a panic, a wallet set up in a hurry, a backup skipped. The Yaroch case is a reminder to slow down and check the basics before moving anything.

What happens next

Three things are still open. First, the sentencing on March 4, 2027, should produce the first final accounting of the stolen assets — a forfeiture or restitution figure that will show how much of the $2.47 million is actually gone for good. Second, the question of how the FBI now restricts and monitors access to wallet credentials: the public record does not describe the bureau's credential storage, its access alerts, or any changes made after the theft, and the criminal case does not have to answer that question. Third, the operational damage — the compromised investigations, sources, and methods the Justice Department cited — may never be fully disclosed.

One loose end is worth clearing up for readers following the coverage. Early reporting, based on the first court filings, described roughly $1 million stolen in 10 transfers. The November plea covers a much wider pattern: about $2.47 million across roughly 100 transfers through July 2026. The earlier figure was not wrong — it was the first chapter. The plea is the full book.

For crypto holders, the takeaway does not depend on any of those open questions. It is the same lesson the DEA and Secret Service cases taught in 2015 and the NCA case taught in Britain: the seed phrase is the money, and anyone who can see it can spend it. Badge or no badge.

Frequently asked questions

Who is Patrick Yaroch?

Patrick Steven Yaroch, 37, of Ashburn, Virginia, is a former FBI supervisory special agent. He worked in the FBI's Boston Division from 2017 to early 2025, then in the Counterintelligence and Espionage Division from February 2025 until his dismissal in July 2026. He held Top Secret clearance.

How much cryptocurrency did he steal?

The Justice Department puts the fraudulent proceeds at approximately $2.47 million. Yaroch made about 100 fraudulent transfers using credentials tied to 35 separate FBI investigations between December 2024 and July 2026.

How did he steal the crypto without hacking anything?

He used his legitimate access to FBI systems that stored wallet credentials collected during investigations. According to the court affidavit, he searched FBI holdings, memorized wallet passphrases, and transferred the funds to his own wallet. A seed phrase or passphrase authorizes spending for whoever holds it — no hacking required.

Was the stolen crypto recovered?

Partly. On July 31, 2026, investigators moved about $925,400 from Yaroch-controlled accounts into government wallets, and about $165,600 remained in his Kraken account. Devices, seed phrases, and a Trezor wallet were also recovered. The November announcement gives no updated recovery total, so the final amount still missing is not yet public.

Has an FBI agent stolen crypto before?

Yaroch's is the largest known case, but the pattern is old. In 2015, DEA agent Carl Force diverted about $700,000 in Bitcoin and was sentenced to 6.5 years, and Secret Service agent Shaun Bridges stole about $350,000 in Bitcoin and received 6 years. A UK National Crime Agency officer was also prosecuted for stealing Bitcoin from a Silk Road 2.0 investigation.

How can I protect my crypto from insider theft?

Hold your own keys in a hardware wallet, keep your seed phrase offline and private, back it up on metal stored separately from the device, use multisignature control so no single person can move funds alone, and keep only trading funds on exchanges. The five checks in this article cover each step in detail.

Conclusion

An FBI agent stole $2.47 million in crypto from 35 investigations because he could see the seed phrases — and in crypto, seeing the phrase is the same as holding the money. The case will end with a sentencing in March 2027, but its lesson is permanent and it applies to everyone, not just law enforcement: if someone else can see your keys, your coins are theirs to take. Check your setup today. Move your holdings to a hardware wallet, lock your seed phrase away on metal, and set up multisignature control before the next headline reminds you why.

Sources: Coindoo, Fox 5 DC, Crypto Briefing, BusinessToday.