Patrick Yaroch: FBI Spy-Catcher Charged With Taking Nearly $1M in Crypto

On the afternoon of 28 July 2026, Patrick Steven Yaroch sent a Signal message to a former colleague, now at the US Justice Department's National Security Division, and asked to meet about "personal matters". The next day, at FBI headquarters in Washington, he "immediately started to break down as he told his story", according to a sworn FBI affidavit. Yaroch was a supervisory special agent in the FBI's Counterintelligence and Espionage Division, the part of the bureau that hunts foreign spies. His story was that he had been stealing from one of the targets.

Prosecutors allege that over roughly 18 months Yaroch used his Top Secret clearance to find the passwords to cryptocurrency accounts linked to a foreign adversary in FBI files, then moved the money to himself in about 10 to 12 transfers. He told his colleague the total was under $1 million. On 31 July, FBI agents moved crypto valued at about $925,426 out of accounts he controlled and into government wallets. The FBI fired him that day and arrested him that afternoon.

Yaroch has not been convicted of anything. He is charged by criminal complaint in the Eastern District of Virginia with two federal felonies: interstate transportation of stolen goods, securities and money, and receipt of stolen goods, securities and money. Each carries a maximum of 10 years in prison.

The spy-catcher

From 2017 to 2025, Yaroch worked in the FBI's Boston Division on a national security squad focused on a country the court papers call only "Adversarial Nation State 1". He had held a Top Secret clearance with access to the most sensitive compartments of intelligence since May 2017. In about February 2025 he moved to FBI headquarters and was lent to the wider US Intelligence Community, working four days a week in a secure building in Northern Virginia. He lived in Ashburn, Virginia.

The filings never name the country. NBC News reported that it was Russia, citing two people familiar with the matter. No official has confirmed that on the record. The affidavit records Yaroch saying he never dealt with anyone connected to the accounts, "including foreign entities".

His own account of the motive is in the affidavit too. In about November 2024 he came across the adversary's crypto accounts during his casework and was frustrated that the FBI "could not or would not act" against them. He described himself as "spinning out of control" and decided to "take matters into his own hands".

The confession, then the lawyer

The self-reporting was real, and so was the backtracking. After the Justice Department colleague told him to get a lawyer and report himself, Yaroch filed an online self-report with the FBI Security Division, contacted headquarters at 3:57 that afternoon and, minutes later, told staff he had "screwed up". That night agents came to his house in Ashburn to collect his badge. He handed them a slip of paper with his wallet words on it. After he was read his rights, he declined an interview until he had a lawyer and asked for the paper back. The agents returned it.

How the money moved

A crypto wallet is less like a bank account and more like a safe-deposit box with no bank attached. There is no branch manager and no signature check. Control comes down to a "seed phrase", usually 12 or 24 ordinary words created with the wallet. Anyone who types those words into wallet software can spend the money, much as anyone holding a bearer bond can cash it. There is also no bank to reverse a transfer. If an investigator's file records a target's seed phrase, the file is, in effect, the money.

According to the affidavit, Yaroch read up on how crypto works, opened a wallet of his own, searched FBI holdings for the adversary's accounts, memorised the recovery words and moved funds into his wallet about 10 times. The FBI agent who wrote the affidavit noted that Yaroch called them "passphrases" when he meant seed phrases.

On the evening of 30 July, Magistrate Judge William B. Porter signed search warrants. The next morning agents searched the house and seized a Trezor hardware wallet (a USB-sized device that stores crypto keys offline), three passports including a diplomatic one, and the slip of paper. Yaroch unlocked his phone with his face.

At headquarters he had said the money was sitting untouched in one wallet. The phone showed otherwise. His account at Kraken, a US crypto exchange that works like an online broker, held about $188,571, including $165,582 in ordinary dollars and $17,988 in USDC, a "stablecoin" issued by Circle that tracks the dollar one for one. Agents also saw that on or around 23 July about $1.02 million had gone to an unknown service.

©CMZ chart. Source: FBI affidavit

Asked about it, Yaroch said it was Suilend, a lending app on the Sui blockchain that pays interest on deposits, much like a savings account. He had reached it through the Slush wallet app, which he had deleted from his phone. The Suilend balance was $933,757. He told agents he chose Suilend "simply because he liked that the logo was a water droplet." Yaroch signed a consent form, and the FBI's crypto team used his seed phrases to sweep the crypto into government wallets. The $165,582 in plain dollars stayed in Kraken, because cash cannot go into a crypto wallet.

The ChatGPT file

The phone also held his ChatGPT history. On 28 May he asked: "If I had a million dollars, how would you suggest investing it/spending it to maximize profit and return." The chatbot's reply mentioned retiring around 40 and a vineyard life in Portugal's Dão region. On 4 June he asked what to do with "a bucket of money (around $1 million)" to leave the USA and live in the EU. The answer: Portugal, "my top choice for your specific situation". Later questions covered a visa for a stopover in Turkey and a job in Greece.

Agents found a power of attorney dated 15 June letting two Portuguese lawyers register him with Portugal's tax authority, and a TAP Air Portugal booking for him, his wife and child, leaving Washington on 3 September. The FBI said he had not reported a May trip in which he flew to Germany and came home from Portugal; clearance holders must report foreign travel. His lawyer said only that one trip went unreported and called it an administrative oversight. Yaroch told agents the September trip was to see friends and that he was not planning to move money to Portugal. Prosecutors wrote that he "should not be viewed as a selfless Robin Hoodesque figure".

Where the case stands

Prosecutors Kathleen Robeson and Russell Carlberg asked for him to be held until trial, arguing that a former agent was "more capable than most" of slipping supervision. They estimated a sentencing range of at least 41 to 51 months and raised a possible heavier charge under 18 U.S.C. 793, the Espionage Act section on national defence information, which has not been filed. His lawyer, Kyle Boynton, himself a former FBI agent, replied that "FBI agents are not Jason Bournes". He argued the case may rest on statements Yaroch was compelled to make to his employer, which the Supreme Court's 1967 Garrity ruling bars from use against public employees, and put the likely range at 24 to 30 months if Yaroch accepts responsibility.

Magistrate Judge Lindsey R. Vaala ordered his release. On 7 August Senior US District Judge Anthony J. Trenga rejected the government's appeal and set a $50,000 unsecured bond, signed by Yaroch and his parents as custodians, plus an electronic location monitor. On 11 August, with both sides agreeing, Judge Leonie M. Brinkema extended the deadline to indict him to 4 October 2026. The public docket shows no indictment, no plea and no trial date. Some crypto news sites reported that he had been indicted or had pleaded guilty. The court record shows neither.

He would not be the first federal agent to help himself to crypto from a case. In 2015 DEA agent Carl Force got 78 months and Secret Service agent Shaun Bridges 71 months for stealing bitcoin during the Silk Road investigation. Neither of them turned himself in.