Patrick Stephen Jaroch, 41, was arrested on July 31 at his home in Ashburn, Virginia, and taken to the Alexandria detention center. The same day, federal prosecutors filed a criminal complaint in the U.S. District Court for the Eastern District of Virginia, charging him with interstate transportation of stolen property and disposal of stolen property.
Both charges relate to cryptocurrency which, prosecutors allege, he surreptitiously removed from wallets belonging to a counterintelligence target deemed a national security threat. Jaroch had worked national security investigations for about eight years at the FBI's Boston field office before moving to a supervisory position at FBI Headquarters in early 2025.
This assignment placed him in the Counterintelligence and Espionage Section, where he had access to highly classified intelligence systems. Cryptocurrency cases often require investigators to seize wallet credentials as evidence, making the custody chain and internal access controls just as critical as the blockchain itself.
Turning Seed Phrases into Cash
According to a sworn affidavit from an FBI Washington Field Office counterintelligence agent, Jaroch discovered seed phrases — the recovery words that grant full control over a cryptocurrency wallet — while working on an investigation concerning a foreign target in late 2024 or early 2025. Prosecutors allege he input these recovery phrases into wallets under his control and transferred funds from the suspect's accounts approximately 10 to 12 times.
Investigators note the alleged theft was not based on complex blockchain tricks or hidden vulnerabilities. Possession of valid recovery phrases essentially equates to ownership of the cryptocurrency. Once those words are entered into compatible wallet software, transactions on the blockchain appear legitimate, as the network cannot distinguish the authorized owner from someone who improperly obtained the credentials.
According to the affidavit, Jaroch told investigators that, observing law enforcement's inaction regarding the victim's cryptocurrency activity, he became frustrated and decided to "take matters into his own hands." He also stated he never communicated with anyone connected to these wallets and emphasized that the majority of the funds remained in wallets under his control, rather than being widely spent.
A Confession Before Investigators Arrived
The investigation began with Jaroch walking into authorities himself, not with agents tracking his activity on the blockchain. On July 28, he contacted a Department of Justice National Security Division official via the Signal app and later met with him in person. According to the affidavit, he became emotional, admitted to making "very poor decisions regarding crypto wallets," and described the situation as "eating at him from the inside." The DOJ official advised him to get a lawyer and turn himself in immediately.
Jaroch then contacted FBI headquarters and told security staff he had "messed up." Later that evening, agents arrived at his home to retrieve government property and relieve him of duty. He briefly provided a written list of wallet recovery phrases but then withdrew his consent. Investigators said he then stated, "I f**ked up," before invoking his right to remain silent. The FBI fired him two days later, the same day he was arrested.
Following the Blockchain Trail
Investigators traced the alleged proceeds across several platforms, rather than finding them hidden behind complex money-laundering schemes. Approximately $188,570 was held in a Kraken account linked to a TD Bank account, which prosecutors allege Jaroch accessed using his phone's facial recognition feature. Another $1.02 million was transferred into Suilend — a decentralized lending protocol — via an app called Slush in late July.
According to investigators, Jaroch stated he chose Suilend partly because he liked its droplet logo and placed the funds there to earn yield while the cryptocurrency was idle. This detail is notable because DeFi lending protocols typically leave permanent records on the blockchain, providing investigators a clear evidentiary trail once the wallet owner is identified.
With Jaroch's consent on July 31, the FBI transferred approximately $925,426 from the Kraken and Suilend accounts to government-controlled wallets. Another $165,582 remained in the Kraken account because that balance had already been converted to U.S. dollars and could not be returned using the same cryptocurrency transfer procedure.
Portugal Plans Raise New Questions
Analysis of Jaroch's phone data broadened the investigation beyond the alleged cryptocurrency theft and into the realm of generative artificial intelligence (AI). Investigators found ChatGPT conversations from May and June where he pondered how roughly $1 million could fund his retirement by age 40, allowing him to live on a vineyard in Italy or Portugal. Other chats involved inquiries about obtaining European Union residency, with Portugal discussed in the context of his family circumstances.
Investigators also found flight bookings for Jaroch, his wife, and child for a September 3 flight from Washington to Lisbon with a return on September 11. Power of attorney documents dated mid-June, authorizing Portuguese lawyers to handle tax and registration matters, were reportedly found on the phone. Agents also identified earlier trips this year to Germany, Portugal, and Grenada that allegedly were never disclosed despite reporting requirements tied to his security clearance.
Jaroch denied any intention to transfer the cryptocurrency overseas, telling investigators the Portugal trip was solely intended to visit friends.
Close Watch for the Next Filing
The FBI stated that upon learning of the allegations, it acted promptly by firing Jaroch and initiating a full criminal investigation. The case now moves to federal court in Alexandria, where prosecutors will seek an indictment if the matter isn't resolved otherwise.
Documents to watch for on the docket are likely to include a motion for detention, a formal indictment or plea agreement, and any additional charges related to undisclosed foreign travel or security clearance reporting. The identity of the foreign intelligence target and adversary country remain undisclosed, suggesting some of the most significant details may only emerge much later in the investigation.
end-content
