FBI Spy Hunter Stole $1M Crypto From His Own Target, Feds Say

Exploiting Trusted Access

Patrick Steven Yaroch, 41, was arrested July 31 at his Ashburn, Virginia, home before being taken to the Alexandria Detention Center. Federal prosecutors filed a criminal complaint the same day in the U.S. District Court for the Eastern District of Virginia, charging him with interstate transportation of stolen property and receipt of stolen property.

Both counts stem from cryptocurrency that prosecutors say he quietly removed from wallets belonging to an adversarial foreign intelligence target. Yaroch spent roughly eight years handling national security investigations in the FBI’s Boston Division before moving into a supervisory position at FBI headquarters in early 2025.

That assignment placed him inside the Counterintelligence and Espionage Division with access to highly restricted intelligence systems. Cases involving cryptocurrency routinely require investigators to secure wallet credentials as evidence, making chain-of-custody and internal access controls just as important as the blockchain itself.

Turning Seed Phrases Into Cash

According to an affidavit from an FBI Washington Field Office counterintelligence agent, Yaroch discovered seed phrases, the recovery words that provide complete control over a cryptocurrency wallet, while working on an investigation involving the foreign target in late 2024 or early 2025. Prosecutors allege he imported those recovery phrases into wallets under his own control and transferred funds from the target’s accounts roughly 10 to 12 separate times.

Investigators say the alleged theft did not rely on advanced blockchain tricks or hidden exploits. Possession of valid recovery phrases is effectively ownership in cryptocurrency. Once those words are entered into compatible wallet software, transactions appear legitimate onchain because the network cannot distinguish an authorized owner from someone who improperly obtained the credentials.

Yaroch told investigators he became frustrated watching the government fail to act against the target’s cryptocurrency activity and decided to “take matters into his own hands,” according to the affidavit. He also claimed he never communicated with anyone connected to the wallets and stressed that most of the funds remained parked in wallets under his control rather than being widely spent.

A Confession Before Investigators Arrive

The investigation began with Yaroch walking through the door himself rather than agents tracking blockchain activity back to him. On July 28, he contacted a Justice Department National Security Division employee over Signal before meeting in person. According to the affidavit, he became emotional, admitted making “very poor decisions related to cryptocurrency wallets,” and described the situation as “eating him up inside.” The DOJ employee advised him to retain counsel and immediately report himself.

Yaroch then contacted FBI headquarters and informed security personnel that he had “screwed up.” Agents arrived at his residence later that evening to recover government property and place him on administrative leave. He briefly surrendered a written list of wallet recovery phrases before withdrawing consent. According to investigators, he then stated, “I fu**ed up,” before invoking his right to remain silent. The FBI terminated his employment two days later, the same day he was arrested.

Following the Blockchain Trail

Investigators traced the alleged proceeds through multiple platforms rather than finding them hidden behind elaborate laundering techniques. Roughly $188,570 sat inside a Kraken account connected to a TD Bank account that prosecutors say Yaroch accessed using facial recognition on his phone. Another $1.02 million had been transferred into Suilend, a decentralized lending protocol, through an application called Slush during late July.

According to investigators, Yaroch said he chose Suilend partly because he liked its water-droplet logo and deposited the assets there to generate yield while the cryptocurrency remained idle. That detail stands out because decentralized finance (DeFi) lending protocols routinely leave permanent onchain records, giving investigators a straightforward trail once wallet ownership is identified.

With Yaroch’s consent, the FBI transferred approximately $925,426 from the Kraken and Suilend accounts into government-controlled wallets on July 31. Another $165,582 remained inside the Kraken account because the balance had already been converted into U.S. dollars and could not be recovered through the same cryptocurrency transfer process.

Portugal Plans Raise More Questions

A review of Yaroch’s phone expanded the investigation beyond the alleged cryptocurrency theft and into the realm of generative artificial intelligence (AI). Agents recovered ChatGPT conversations from May and June in which he explored how roughly $1 million could fund retirement before age 40 while living on a vineyard in Italy or Portugal. Additional chats asked about obtaining European Union residency, with Portugal discussed based on his family’s circumstances.

Investigators also found airline reservations for Yaroch, his wife and child to travel from Washington to Lisbon on Sept. 3 before returning Sept. 11. The phone reportedly contained powers of attorney prepared in mid-June authorizing Portuguese lawyers to handle tax and registration matters. Agents also identified earlier trips this year to Germany, Portugal and Grenada that allegedly were never disclosed despite security clearance reporting requirements.

Yaroch denied planning to move the cryptocurrency overseas, telling investigators the Portugal trip was intended only to visit friends.

Watching the Next Filing Carefully

The FBI said it moved quickly after learning of the allegations, terminating Yaroch and opening a full criminal investigation. The case now heads into federal court in Alexandria, where prosecutors will seek an indictment unless the matter is resolved through another avenue.

The filings to watch in the docket are likely to be a detention hearing, a formal indictment or a plea agreement, along with any additional charges connected to undisclosed foreign travel or security clearance reporting. The identity of the foreign intelligence target and the adversarial nation remain sealed, suggesting some of the most consequential details may not emerge until much later in the case.