A 41-year-old former FBI counterintelligence agent has been charged with stealing nearly $1 million worth of cryptocurrency from an encrypted wallet belonging to an adversary in a spy case he himself was handling. His method involved memorizing the wallet's seed phrase, leaving no physical trace, and transferring the funds in roughly 10 to 12 installments into his own account over a period of more than a year without detection. On July 31, he was arrested at his home in Ashburn, Virginia, facing two federal charges: 'interstate transportation of stolen property' and 'receipt of stolen property.' The FBI has reportedly recovered approximately $925,000.
At this point, one might be most curious about how, as an agent, he was exposed. This is the most ironic twist of the case: he wasn't caught through an investigation; he turned himself in. Three days prior, he arranged a meeting with Department of Justice personnel via Signal. As soon as he sat down, he broke down, confessing that he had 'made a terrible decision regarding the crypto wallet' and that it had been 'haunting him.' Even more absurdly, police retrieved his phone and found the escape plans he had consulted ChatGPT about.
A Spy Catcher Turns to Stealing
The defendant is Patrick Steven Yaroch, 41, an FBI supervisory special agent. He first spent about eight years conducting national security investigations at the Boston Field Office. In early 2025, he transferred to FBI Headquarters, joining the Counterintelligence and Export Control Section, where he gained access to highly restricted intelligence systems.
According to his own statements to investigators, while working on a counterintelligence case in November 2024, he gained access to the adversary's crypto account. He didn't stop at mere 'access.' He researched cryptocurrency, created his own wallet, then went back to search the FBI's database for information on the adversary's crypto account, memorizing the seed phrase one string at a time.
His affidavit is even more blunt—he 'accessed the FBI system, found the keys needed for the transfers.' After that, he transferred money from these adversary accounts into a single wallet under his own name in approximately 10 to 12 batches, amassing nearly $1 million. He claimed he wasn't sure of the exact amount, as it became mixed with his personal investment gains, but it was under a million.
Two details here are worth pausing on. First, the affidavit consistently uses the plural—'adversary accounts,' 'searching FBI databases for information on adversary crypto accounts.' In other words, the FBI database contained wallet credentials for more than one target, stored in a form that an agent could directly search and see the seed phrase in plain text. What he could memorize, in theory, wasn't limited to just this one person's. Second, the agent specifically added a footnote correcting him: Yaroch referred to the seed phrase as a 'passphrase,' which is incorrect terminology. This indicates that while Yaroch worked in counterintelligence, his understanding of crypto terminology was rudimentary.
Investigators also pointed out this was not some sophisticated hack; there was no exploit, no attack. Possessing the seed phrase equates to possessing the wallet. Entering the phrase into any wallet software results in a transaction that appears normal on-chain; the network cannot distinguish between the true owner and the person with the keys.
As for how these adversary seed phrases initially entered the FBI database and why they were stored in a retrievable, memorizable format—the affidavit does not say. The foreign target and country involved remain classified and redacted.
Yaroch's self-professed rationale: he was frustrated that the government wasn't taking action against this target's crypto activities, so he decided to 'take matters into his own hands.' He also emphasized that he never contacted anyone associated with these accounts and that the money was just sitting there, unspent. These are his claims alone.
Planned to Retire Before 40, Grow Grapes in Portugal
Once he had the money, he began planning for the rest of his life. But this counterintelligence expert typed out his planning process, line by line, to ChatGPT.
Conversations recovered from his phone from May and June show he asked how to retire before 40 with $1 million, living in a vineyard in Italy or Portugal; he also inquired about obtaining EU residency, specifically discussing Portugal in detail regarding his family situation.
His actions matched these plans perfectly: he had booked round-trip tickets for his family from Washington to Lisbon for September 3, returning September 11; in mid-June, he prepared a power of attorney for a Portuguese lawyer to handle tax and registration matters. Investigators also found records of his travel to Germany, Portugal, and Grenada this year. According to security clearance regulations, such trips must be reported; he failed to report any of them. When questioned, he insisted he had no plans to transfer the money overseas, claiming the trip to Portugal was merely to visit friends.
Transferred Money into Suilend Because He Liked the Logo
Yaroch's method of moving the funds was hardly covert. Approximately $188,500 was held in a Kraken account linked to a TD Bank account, accessed via facial ID on his phone. Another $1.02 million was transferred in late July via an application called Slush into Suilend, a decentralized lending protocol on the Sui blockchain.
His reason for choosing Suilend was rather absurd: according to investigators, he said it was partly because he liked the water-drop-shaped logo, and he wanted to deposit the money to earn some yield, letting the coins sit. The problem is, DeFi lending protocols leave permanent on-chain records. Once a wallet's ownership is identified, following the trail is straightforward.
On July 31, with his consent, the FBI transferred the combined total of approximately $925,000 from Kraken and Suilend into a government-controlled wallet. Another $165,500 remained in Kraken—this portion had already been converted to US dollars and could not be recovered using the same crypto transfer process.
He Didn't Wait for the Investigation; He Contacted the DOJ First
On the afternoon of July 28, Yaroch proactively contacted a former colleague at the Department of Justice's National Security Division via Signal. They met the next day at noon at FBI Headquarters. According to the affidavit, he broke down emotionally upon meeting, admitting he had made a terrible decision regarding the crypto wallet, saying it had been haunting him and he wanted to 'get it off his chest.' The colleague advised him to get a lawyer immediately and turn himself in.
That same afternoon, he again proactively contacted FBI Headquarters requesting a meeting. He also submitted a self-report online to the security office. When he met with agents, he immediately said he had 'screwed up.' That evening, agents went to his Ashburn home, placed him on administrative leave, and confiscated government property. During this, he handed over a piece of paper with the seed phrase written on it, only to retract his consent and take it back a few minutes later, repeatedly muttering 'I screwed up.' He then invoked his right to remain silent. On July 31, the FBI formally dismissed him; later that same day, after he cooperated in transferring the funds back to the government wallet, agents arrested him on the spot.
His explanation for turning himself in was shame, knowing he had done wrong. Whether this stemmed more from a guilty conscience or a sense that an investigation was imminent and he wanted to confess first, the affidavit does not conclude, nor is it necessary to judge for him.
What This Case Reminds Ordinary People
First, chat logs can truly become courtroom evidence. The questions Yaroch asked ChatGPT—about retiring, immigrating, which vineyard to go to—ended up listed one by one in the case file. What you might think is just a casual query in a chatbox is, in fact, completely unguarded.
Second, and more thought-provoking for the industry: The FBI's database contained the seed phrases of adversary wallets in plain text. An agent could directly retrieve them, memorize them, transfer out nearly a million dollars, and go undetected for over a year, only to be caught because his own conscience forced him to confess. When discussing crypto asset security, we often focus on whether exchanges might collapse or cold wallets might be lost. Rarely do we consider that even the evidentiary credentials held by law enforcement could be guarded so loosely. And how did these seed phrases initially end up in the FBI's database, and why were they stored in a format that could be memorized by a single person?
