A former FBI agent has pleaded guilty to stealing roughly $2.47 million in cryptocurrency that the FBI had seized during its investigations — a total more than double the amount he first admitted when he came forward in July.

Patrick Steven Yaroch, 37, of Ashburn, Virginia, entered a guilty plea on Thursday to charges of wire fraud and money laundering. He initially confessed to a Justice Department colleague in late July, saying he had moved funds about 10 to 12 times into a single wallet worth around $1 million. He said he could not be certain of the exact total because he had mingled the stolen money with his own investment gains, and that the shame was "eating him up inside" and he wanted to "get it off his chest."

How an FBI insider siphoned seized crypto

The guilty plea revealed a far larger scheme. According to the Justice Department, Yaroch carried out approximately 100 fraudulent transfers using wallet credentials drawn from 35 separate FBI investigations. He then moved the funds through crypto swaps and additional transactions to conceal their origin, and spent part of the proceeds on credit card bills, car payments and other loans.

Yaroch worked at the FBI's Boston office from 2017 to early 2025, serving on a team that investigated an unnamed foreign adversary of the United States. NBC News, which is owned by Comcast (NASDAQ: CMCSA), reported that the country was Russia. He later transferred to the FBI's Counterintelligence and Espionage Division, where he had access to internal systems that stored crypto wallet keys collected during cases.

Yaroch told investigators that he first studied how crypto wallets work and created wallets of his own. He then combed through FBI files for account information and memorized the secret phrases that unlock the funds. No hacking was involved: the keys were sitting inside an FBI system, and he copied them. Because whoever holds a wallet's keys controls its funds, the scheme depended not on defeating any cryptographic defense but on ordinary access to the government's own records — the same access granted to agents handling seized assets every day.

ChatGPT, a vineyard plan and a home search

Federal agents found chat logs in which Yaroch asked ChatGPT what to do with about $1 million and how to live in an EU country. The chatbot suggested buying a vineyard in Portugal, and Yaroch went on to hire lawyers there to obtain a tax number.

Agents who searched Yaroch's home in Ashburn recovered a Trezor crypto device, handwritten recovery phrases, a Portuguese legal document granting someone power to act on his behalf, and three passports, according to court filings. He faces up to 20 years in prison and is due to be sentenced on March 4, 2027.

A pattern of insider theft of government crypto

Yaroch's case is the second this year in which a person with government access was caught taking cryptocurrency controlled by the U.S. government. In early March, the FBI arrested John "Lick" Daghita on the Caribbean island of Saint Martin over accusations that he took more than $46 million from the U.S. Marshals Service.

Daghita is the son of the chief executive of Command Services & Support, a Virginia company that held a Marshals contract to help manage and sell seized digital assets, as Cryptopolitan reported. That contract reflects how seized digital assets are commonly handled: agencies hire private firms to help manage and sell the holdings. On-chain investigator ZachXBT exposed Daghita after he showed off $23 million in a Telegram group chat. Yaroch has now admitted the conduct in a plea, while the Daghita case remains at the accusation stage.

An earlier case involved Shaun Bridges, a former Secret Service agent, and Carl Force, a former Drug Enforcement Administration agent, who served on a Baltimore task force investigating the Silk Road marketplace. Bridges pleaded guilty and was sentenced to nearly six years in prison for stealing more than $800,000 in Bitcoin during that investigation. Months after he was first charged, he was accused of taking another $700,000 from a Secret Service account.

Source: Cryptopolitan