A former FBI supervisory special agent has been charged with allegedly stealing nearly $1 million in cryptocurrency from wallets under FBI monitoring, a case that places the handling of seized digital assets and recovery credentials under fresh scrutiny inside federal law enforcement.
Patrick Steven Yaroch, 37, is accused of using recovery words accessed through FBI systems to move cryptocurrency from monitored accounts into wallets he controlled, according to a criminal complaint unsealed in the U.S. District Court for the Eastern District of Virginia. Prosecutors allege that Yaroch memorized the recovery phrases and used roughly 10 to 12 transactions to obscure the path of the funds before consolidating them in a personal wallet.
The complaint charges Yaroch with interstate transportation of stolen goods and receipt of stolen goods. The case remains pending, and the allegations have not been tested at trial.
Prosecutors allege assets reached personal wallets and defi protocol
Yaroch worked from the FBI’s Boston field office beginning in 2017 and handled national security matters involving what the filings describe as “hostile nations.” He held Top Secret clearance with Sensitive Compartmented Information access, according to the complaint, and worked at the GS-14 pay grade, with an annual salary listed between $180,000 and $230,000.
Prosecutors say the alleged theft began in late 2024 or early 2025, while Yaroch was assigned to Boston. The cryptocurrency was allegedly moved through several transfers before being concentrated in a wallet worth about $1 million.
The filing describes an alleged effort to use the assets in ways that kept them within the crypto financial system rather than immediately converting the full balance into cash. Some funds were reportedly sent to a personal Kraken account. Other amounts were routed through a Slush wallet and deposited into Suilend, a decentralized lending protocol, where they could potentially earn yield.
That alleged sequence matters for investigators because cryptocurrency transfers create permanent on-chain records, even when funds pass across several wallets or protocols. Moving assets through multiple addresses can complicate attribution, but it does not erase the underlying transaction trail.
The complaint says Yaroch later provided recovery materials to authorities, including a written note and a Trezor hardware wallet.
Travel records and chatgpt queries cited in complaint
The criminal filing also cites ChatGPT queries that prosecutors say were connected to Yaroch’s handling of the alleged proceeds. Extracted logs reportedly showed questions on May 28, 2026, about investing or spending $1 million, followed by a June 4 query about leaving the United States for a European country with $1 million.
Court records also describe planned travel from Washington to Lisbon and Porto from Sept. 3 through Sept. 11, 2026 for Yaroch, his wife and his child. Since those dates are after the July arrest described in the complaint, the itinerary appears to reflect booked travel rather than a completed trip.
Prosecutors further allege that Yaroch signed a power of attorney on June 15, 2026, authorizing a Portuguese lawyer to assist with a tax identification number, customs matters and financial affairs. The filing says he later collected a password in person from a finance office.
The complaint cites other overseas travel that prosecutors say was not reported to the FBI, including trips to Germany and Portugal in May 2026 and a trip to Grenada between late June and early July. Federal authorities presented the travel, Portuguese documentation and financial planning activity as factors relevant to potential flight risk and possible planning around asset movement.
Yaroch self-reported to the Justice Department and FBI on July 29, 2026, according to the filing. The FBI terminated his employment on July 31 and arrested him the same day.
Recovery phrases create a concentrated security risk
The allegations focus on a vulnerability specific to digital asset investigations: whoever controls a wallet’s private keys or recovery phrase can generally control the funds. A recovery phrase, often a sequence of words generated when a wallet is created, can restore access to a wallet without needing the original device.
That design leaves government agencies managing seized cryptocurrency with a custody problem that differs from holding physical evidence or funds in a conventional bank account. Wallet access can be divided among multiple authorized officials, held through multi-signature arrangements requiring several approvals, or placed with specialized custodians. Yet the complaint alleges that Yaroch was able to access enough recovery information through FBI systems to reconstruct control over wallets tied to an investigation.
The case does not establish how widely such access was available across the FBI or whether the affected wallets used multi-signature controls. It does show how a single employee with knowledge of recovery materials could allegedly transfer assets without an immediate external sale, creating a window in which the theft could remain less visible than a large conversion through a traditional financial institution.
Earlier cases showed similar insider risks
Federal law enforcement has previously prosecuted agents accused of stealing cryptocurrency connected to investigations. In the Silk Road-related cases, former Drug Enforcement Administration agent Carl Mark Force IV admitted moving more than $700,000 in cryptocurrency and received a 6.5-year prison sentence.
Former U.S. Secret Service agent Shaun W. Bridges was sentenced to 71 months after moving more than 20,000 bitcoin, then valued at roughly $800,000, through Mt. Gox. He later received an additional 24-month sentence in 2017 in connection with the theft of approximately 1,600 bitcoin from a government wallet.
Those cases emerged when bitcoin traded at far lower prices than today, making the operational stakes much larger for agencies now responsible for substantial digital asset seizures. The Justice Department’s case last year against Cambodian Prince Group founder and chairman Chen Zhi illustrated that scale: authorities said they seized 127,000 BTC worth about $15 billion at the time. The government alleged that Chen controlled the non-custodial wallet holding the bitcoin through its private keys.
Yaroch’s case does not involve a seizure on that scale, but it adds pressure for agencies to separate investigative access from unilateral transfer authority. The alleged use of personal wallets, a centralized trading account and a defi lending protocol also shows that internal controls must account for several routes through which assets can be moved, not solely for direct sales from government-controlled addresses.
The prosecution now turns on whether the government can substantiate its claim that Yaroch used FBI-accessed recovery information to take control of the cryptocurrency and whether the documented wallet movements can be tied to him beyond reasonable doubt.
Worried about stolen wallets and recovery phrases? Learn secure storage basics in our guide, crypto storage explained.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
