FBI Agent Used Case Credentials to Steal Millions in Crypto

Crime

Former FBI agent Patrick Yaroch pleaded guilty to stealing roughly $2.5 million in cryptocurrency with wallet credentials gathered during investigations, showing how case access can become spending power.

The Justice Department confirms the plea to wire fraud and money laundering and puts the fraudulent proceeds at approximately $2.47 million.

Where the stolen crypto came from

According to the Justice Department, Yaroch used credentials held in FBI systems to take funds from wallets controlled by investigative subjects or adversarial nation-state actors, as well as from an FBI operational wallet. Only the last of those belonged to the bureau. Describing the full amount as crypto stolen from government seizure accounts would misstate what happened.

That sets the case apart from one Coindoo covered earlier, in which an NCA officer stole Bitcoin from a Silk Road 2.0 investigation. Those coins had already been seized. Apart from the operational wallet, Yaroch’s targets were wallets the FBI held credentials for because of its investigations, not coins the announcement describes as being in government custody.

How case access turned into spending power

The August 1 court affidavit, archived by CourtListener, gives the earliest account of the method. It records Yaroch telling investigators that he searched FBI holdings, memorized wallet passphrases and then transferred the funds to a wallet of his own.

A memorized passphrase was enough because of how crypto wallets work. An address identifies where funds sit but cannot authorize a payment. A usable passphrase or other wallet secret can, and it works for whoever holds it, whether or not that person has any legal right to the assets. Once an investigator can view the secret, examining the evidence and spending the money require the same access.

The affidavit captured Yaroch’s initial version. The plea announcement describes a much wider pattern: about 100 fraudulent transfers using credentials tied to 35 separate investigations.

What had been recovered by the end of July

The affidavit also holds the only recovery figures in the public record. On July 31, investigators moved approximately $925,400 from Yaroch-controlled accounts into government-controlled crypto wallets. A further $165,600 or so in U.S. dollars remained in his Kraken account at that point.

Both are observations from a single date. The November announcement gives no updated recovery total, so subtracting the July transfer from the plea figure would not show what is still missing, particularly after asset conversions and months of changing crypto valuations.

The seizure is also the strongest point in the FBI’s favor. Investigators had secured part of the proceeds before the affidavit was even filed, months ahead of the plea. The record does not say how the theft was detected or how long it ran beforehand, though. The seizure shows that funds were frozen before the case was resolved, not that monitoring caught the transfers early.

The losses that recovered crypto cannot cover

The Justice Department also says Yaroch compromised investigations, sources and methods. It does not identify the affected cases or estimate the operational damage.

That harm sits outside the headline figure, which measures the proceeds of the theft. Returning the crypto can reduce the financial loss. It cannot show whether a compromised investigation remains viable, or whether exposed sources and methods can still be relied on.

The control test for anyone holding wallet secrets

Yaroch’s method points to one question for any organization that stores wallet credentials: can an employee who needs to examine evidence also obtain everything required to spend the associated funds?

The National Institute of Standards and Technology defines least privilege as limiting access to what a person needs for assigned work. Its definition of dual authorization describes controls requiring at least two authorized people to access certain resources.

For wallet secrets, both principles govern who can reveal, copy or use the credential itself. A second approval inside an internal payment workflow protects little if one employee can retrieve the full credentials and move funds outside that workflow, which matches the route Yaroch described to investigators.

These are benchmarks for judging controls, not findings about the FBI. The public record does not describe the bureau’s credential storage, its access alerts or any changes made after the theft.

What the March sentencing could settle

Sentencing is scheduled for March 4, 2027, and Yaroch faces up to 20 years in prison. The hearing is the next point at which the court record could set out a forfeiture or restitution figure, which would provide the first final accounting of the stolen assets. How the FBI now restricts and monitors access to the affected credentials is a separate question that the criminal case does not have to answer.

Author

Related stories

Next article