What the Yaroch plea shows about crypto keys kept in FBI files

A former FBI counterintelligence supervisor admitted on Nov. 5 that he stole about $2.47 million in crypto using wallet credentials the bureau had gathered in its own cases. Patrick Steven Yaroch, 37, of Ashburn, Virginia, pleaded guilty in Alexandria to wire fraud and money laundering, according to the U.S. Attorney's Office for the Eastern District of Virginia.

For anyone who holds crypto, the useful part of the case is simple. Once an investigator copies a seed phrase or private key into a case system, anyone who can read that system can move the coins.

Prosecutors say Yaroch spent 2017 to early 2025 on an FBI Boston squad focused on an adversarial nation state, then joined the Counterintelligence and Espionage Division, where he could reach systems holding crypto credentials collected in investigations. Beginning no later than December 2024, he made about 100 fraudulent transfers using credentials tied to 35 separate investigations. DOJ puts the proceeds at $2,474,380.66.

The wallets belonged to investigation subjects and adversarial nation-state actors, and at least one was a wallet the FBI had created for an operation. The signed statement of facts goes further, as reported by The Block: at least 79 wallets, at least 10 transfers from wallets of crime victims in other FBI cases, and single thefts ranging from 81 cents to more than $580,000. The Block also cites an NBC News report from August, based on two sources, that the nation state in the original complaint was Russia. The DOJ release does not name it.

No encryption was broken. The credentials sat in records an employee could search, and according to the filing he kept checking FBI systems after each theft to see whether anyone had noticed. Custody failures have hit other agencies, as with crypto taken from prosecutors in South Korea, although the funds left that office in a different way. The shared lesson with what happens when wallet credentials are stolen is that a key obeys whoever holds it.

DOJ says Yaroch swapped the stolen coins into other cryptocurrencies, laundered them through further transactions, and moved about $93,082 into one of his accounts between Nov. 25, 2025, and Jan. 13, 2026, to pay credit cards, car payments and loans. In one example from the filing described by The Block, bitcoin from two wallets went through a swap service with privacy features, partly into Monero and then Solana, and through a Sui wallet to his Kraken account. Washington has been arguing over such routes for months, as Treasury's report on crypto privacy tools showed.

Under the plea agreement, per The Block, he must pay at least $2.4 million in restitution, faces a forfeiture judgment of at least $2.4 million, and gives up 17,990.67 USDC, about 1.38 million SUI seized on July 31, and the contents of his TD Bank, Charles Schwab, Kraken and BloFin accounts. He acknowledged that the full proceeds "are not available."

According to DOJ, his conduct compromised several investigations into criminal groups and nation-state adversaries, along with FBI sources and methods. The release says nothing about changes to how the bureau stores the credentials it collects.

Judge Patricia Tolliver Giles accepted the plea, and sentencing is set for March 4, 2027, with up to 20 years in prison possible. Any money Yaroch earns from books, films or interviews about the case will go to the U.S. government, The Block reports.