Former FBI Supervisory Special Agent Patrick Steven Yaroch transferred roughly $925,000 in cryptocurrency from wallets tied to an adversarial-nation investigation into accounts he controlled, then walked into the Justice Department and confessed because the theft was eating him up inside.
Court records unsealed this week show the 37-year-old counterintelligence officer memorized seed phrases from FBI systems, moved funds over roughly a year and a half, parked most of it on a lending platform he liked for its water-droplet logo, asked ChatGPT how to retire in Portugal with a million dollars, and still ended up handing everything back after a guilt collapse.
How the Transfers Happened
Yaroch spent years on a Boston national-security squad focused on an adversarial nation state before moving to FBI Headquarters Counterintelligence and Espionage Division in early 2025. In roughly November 2024 he encountered cryptocurrency accounts linked to a target during that work.
He later told colleagues he grew frustrated that the bureau could not or would not act to disrupt the accounts. He researched how seed phrases unlocked wallets, searched internal holdings, memorized the phrases, created his own wallet, and began moving funds.
He conducted the transfers approximately 10 to 12 times into the same personal wallet. The money sat unused and co-mingled with his own assets. He never contacted anyone tied to the original accounts.
| Item | Detail |
|---|---|
| Transfers | 10-12 times, late 2024 or early 2025 onward |
| Seized total | Approximately $925,426.07 |
| Suilend balance | About $933,757 (mostly invested) |
| Kraken remainder | Roughly $188,571 (partly USD) |
| Hardware | Trezor original wallet seized |
The affidavit detailing the 10-12 transfers records that agents later used the recovered seed phrases, with Yaroch’s consent, to move the crypto into government-controlled wallets on July 31.
The Day Conscience Caught Up
On the afternoon of July 28 Yaroch messaged a former Boston colleague now at the DOJ National Security Division on Signal and asked to meet about personal matters. They met the next day at FBI Headquarters. Yaroch broke down immediately.
He said he had made very poor decisions related to cryptocurrency wallets, gone into FBI systems for the keys, and moved money to himself. It was eating him up inside and he wanted to get it off his chest. He asked about criminal exposure and said he wanted to give the money back.
Hours later he contacted FBI Headquarters, submitted an online self-report to the Security Division, and told personnel he had screwed up. That evening agents placed him on administrative leave at his Ashburn, Virginia home. He handed over credentials and, briefly, a 3-by-5-inch paper with wallet key words before withdrawing consent. “I fucked up,” he told agents who tried to interview him.
On July 31 agents executed search warrants, recovered the seed paper, phones, computers, passports and the Trezor. Yaroch unlocked his Kraken app with Face ID and helped locate the Suilend funds. He signed a consent form. Agents completed the transfers. At 4:43 p.m. they arrested him on probable cause. He was fired the same day.
As soon as the FBI became aware of these allegations, we immediately took action, began an investigation, and ultimately executed an arrest warrant for this individual last week. We hold our employees to the highest ethical standards, and this conduct is not tolerated at the FBI.
An FBI spokesperson gave that statement to CNN and other outlets. The agency said a thorough investigation continues and offered no further comment.
ChatGPT Drew the Portugal Map
Phone forensics showed the ChatGPT app logged in under Yaroch’s name. The queries arrived weeks before the confession and tracked a clear fantasy.
- May 28, 2026, 6:04 p.m.: “If I had a million dollars, how would you suggest investing it/spending it to maximize profit and return.” Response referenced age 37, young family, retire around 40, slower-living vineyard lifestyle in Cilento or Portugal’s Dão region.
- June 4, 2026, 8:35 a.m.: “If you had a bucket of money (around $1 million) and you wanted to leave the USA and become a resident or citizen of an EU country, what would you do?” ChatGPT named Portugal its top choice for the family situation, red-wine interest and desire to live there rather than just own property.
- June 17: Visa question about connecting in Turkey.
- June 26: Draft email about a job and life in Greece.
Agents also found a TAP Air Portugal app with family tickets: Washington to Lisbon September 3-4, onward to Porto, return September 11. Power-of-attorney documents dated June 15, 2026, gave two Portuguese lawyers broad authority to obtain a tax ID and handle tax-authority matters for him. Yaroch told agents the September trip was to meet friends and that he hoped his wife and child could still go even if he could not.
- May 14, 2026: Unreported travel Washington to Germany.
- May 25, 2026: Return from Portugal, also unreported.
- June 30-July 5, 2026: Unreported trip to Grenada.
- June 15, 2026: Portugal power-of-attorney signed.
- September 3-11, 2026: Booked family Portugal itinerary.
He told agents he was not planning to funnel money into Portugal. The documents and tickets sat in the same house where the seed phrases lived.
This Has Happened With Bitcoin Before
In 2015 federal prosecutors charged two Baltimore Silk Road task-force agents with similar conduct. DEA Special Agent Carl M. Force and U.S. Secret Service Special Agent Shaun W. Bridges allegedly diverted digital currency they controlled during the investigation into personal accounts, used complex transactions, and in Bridges’ case moved more than $800,000.
The 2015 Silk Road task-force charges described undercover personas, unauthorized seizures and personal enrichment from the very targets they were paid to pursue. Force and Bridges both faced wire-fraud and money-laundering counts. The pattern is older than Yaroch’s case: agents with access sometimes treat seized or monitored crypto as personal inventory.
Crowd reaction on X immediately paired the two stories. One widely shared post noted the earlier thefts and wondered how often agents get away with it. Others called Yaroch an amateur for stopping at roughly a million and then confessing. The parallel lands because both episodes turned investigative access into private wallets and both ended in federal charges once the paper trail or conscience surfaced.
Seed Phrases Sat Inside the System
Yaroch held a Top Secret clearance with SCI access since 2017. He worked as a detailee in a secure non-FBI building most days. The seed phrases lived in FBI holdings he could search. He simply memorized them.
That access is the practical hole. Crypto investigations routinely generate private keys or seed phrases when agents seize or monitor wallets. Storage, logging and dual-control rules exist, yet one supervisory agent with legitimate case need extracted what he needed for months without immediate detection.
- Clearance level: Top Secret / SCI since May 2017
- Role: Supervisory Special Agent, Counterintelligence and Espionage Division, plus Intelligence Community detail
- Method: Internal search + memorization of seed phrases
- Duration undetected: Roughly 18 months of transfers
After the seizure the bureau placed him on leave within hours of the first confession and fired him two days later. The speed shows the agency can move when the admission arrives. The longer undetected period shows the controls did not flag the earlier activity. Similar risks appear in other state-linked cyber operations where credentials or keys become the prize.
Artificial-intelligence tools now sit inside the same investigations. Yaroch used ChatGPT for life planning, not for the theft itself. Still, the episode lands beside broader questions about how agents and contractors handle both crypto secrets and AI assistants. Deals such as the push for tools meant to secure AI agents exist precisely because sensitive data and automated systems now mix daily.
What the Charges Carry
Prosecutors charged Yaroch with interstate transportation of stolen goods, securities and monies under 18 U.S.C. § 2314 and receipt of stolen goods under 18 U.S.C. § 2315. He appeared before a magistrate in the Eastern District of Virginia on August 3. The government sought detention. A temporary detention order followed; further hearings were set.
No attorney of record appeared in the initial public filings. Yaroch had told agents he wanted legal advice before more interviews. He cooperated with the physical search and the crypto transfers once on scene. The funds themselves are now in government wallets. The remaining Kraken USD balance stayed in place because it could not move the same way.
His family faced an immediate practical hit: the September Portugal trip, the power-of-attorney arrangements, and the sudden loss of his salary and clearance. He expressed hope they could still travel. The unreported foreign trips in 2026 already violated security rules and compounded the clearance problems.
The adversarial-nation wallets that started the story remain only lightly described in public papers. Multiple outlets have reported the target as linked to Russia; the affidavit itself uses the redacted label “ADVERSARIAL NATION STATE 1.” Whatever the nationality, the original investigative purpose was counterintelligence and disruption. Yaroch’s private transfers achieved neither lasting disruption nor personal freedom.
He took the money to act where he believed the bureau would not. Months later the same conscience that let him justify the first transfer forced the confession that undid every one of them. The Portugal vineyard, the early retirement, the million-dollar bucket all existed only in ChatGPT logs and a folder of travel documents. The hardware wallet, the seed paper and the arrest warrant were real.
