A former FBI agent has pleaded guilty to wire fraud and money laundering after prosecutors said he used credentials from active case files to steal roughly $2.47 million in cryptocurrency — most of it from wallets the bureau did not own. A federal judge in the Eastern District of Virginia accepted the plea on November 5, and the Justice Department announced the charges.

Where the Stolen Crypto Came From

According to the Justice Department, Yaroch used credentials held in FBI systems to take funds from wallets controlled by investigative subjects or adversarial nation-state actors, as well as from an FBI operational wallet. Only the last of those belonged to the bureau. The remaining targets were wallets the FBI held credentials for because of its investigations — not coins the announcement describes as being in government custody. Describing the full amount as crypto stolen from government seizure accounts would therefore misstate what happened.

That distinction sets the case apart from an earlier matter Coindoo covered, in which an NCA officer stole Bitcoin from a Silk Road 2.0 investigation. Those coins had already been seized. The two cases do share one core feature: a trusted law-enforcement insider converting access to case-related crypto into personal gain, whatever the custody status of the funds happened to be.

How Case Access Turned Into Spending Power

The earliest account of the method appears in an August 1 court affidavit — a sworn written statement filed in court — archived by CourtListener. It records Yaroch telling investigators that he searched FBI holdings, memorized wallet passphrases and then transferred the funds to a wallet of his own.

A memorized passphrase was enough because of how crypto wallets work. An address identifies where funds sit but cannot authorize a payment. A usable passphrase or other wallet secret can — and it works for whoever holds it, whether or not that person has any legal right to the assets. Once an investigator can view the secret, examining the evidence and spending the money require the same access.

The affidavit captured Yaroch's initial version of events. The plea announcement describes a much wider pattern: roughly 100 fraudulent transfers using credentials tied to 35 separate investigations.

What Had Been Recovered by the End of July

The affidavit also holds the only recovery figures in the public record. On July 31, investigators moved approximately $925,400 from Yaroch-controlled accounts into government-controlled crypto wallets. A further $165,600 or so in U.S. dollars remained in his account on the Kraken exchange at that point.

Both figures are observations from a single date. The November announcement gives no updated recovery total, so subtracting the July transfer from the plea figure would not show what is still missing, particularly after asset conversions and months of shifting crypto valuations.

The seizure also stands as the strongest point in the FBI's favor: investigators had secured part of the proceeds before the affidavit was even filed, months ahead of the plea. The record does not say how the theft was detected or how long it ran beforehand, however. What the freeze demonstrates is that funds were locked down before the case was resolved — not that monitoring caught the transfers early.

The Losses Recovered Crypto Cannot Cover

The Justice Department also says Yaroch compromised investigations, sources and methods. It does not identify the affected cases or estimate the operational damage. That harm sits outside the headline figure, which measures the proceeds of the theft. Returning the crypto can reduce the financial loss; it cannot show whether a compromised investigation remains viable or whether exposed sources and methods can still be relied on.

The Control Test for Anyone Holding Wallet Secrets

Yaroch's method points to one question for any organization that stores wallet credentials: can an employee who needs to examine evidence also obtain everything required to spend the associated funds?

The National Institute of Standards and Technology defines least privilege as limiting access to what a person needs for assigned work. Its definition of dual authorization describes controls that require at least two authorized people to access certain resources. For wallet secrets, both principles govern who can reveal, copy or use the credential itself. A second approval inside an internal payment workflow protects little if one employee can retrieve the full credentials and move funds outside that workflow — which matches the route Yaroch described to investigators.

These are benchmarks for judging controls, not findings about the FBI. The public record does not describe the bureau's credential storage, its access alerts or any changes made after the theft.

What the March Sentencing Could Settle

Sentencing is scheduled for March 4, 2027, and Yaroch faces up to 20 years in prison. The hearing is the next point at which the court record could set out a forfeiture or restitution figure, which would provide the first final accounting of the stolen assets. How the FBI now restricts and monitors access to the affected credentials is a separate question the criminal case does not have to answer.

This article originally appeared on Coindoo.