FBI Agent Steals from Within: Millions in Cryptocurrency Stolen by Memorizing Recovery Phrases

marsbitPublicado em 2026-08-09Última atualização em 2026-08-09

Resumo

A criminal complaint filed in the U.S. District Court for the Eastern District of Virginia details the case of Patrick Steven Yaroch, a former FBI supervisory special agent. Yaroch is accused of using his position to steal nearly $1 million in cryptocurrency from accounts associated with a "foreign adversary" (reportedly Russia) that were under FBI monitoring. He allegedly accessed the accounts' seed phrases from an FBI system, memorized them, and transferred the funds to personal wallets over 10-12 transactions in late 2024 or early 2025. Some stolen assets were held on the Kraken exchange and others were deposited into the Suilend DeFi protocol to earn yield. Despite his senior GS-14 position and high security clearance, Yaroch claimed his actions stemmed from frustration with the FBI's perceived inaction against the monitored accounts. However, evidence from his phone, including ChatGPT conversations from May and June 2026, revealed plans to move to Europe (specifically Portugal) with $1 million and retire early. He booked flights for his family and initiated steps for Portuguese residency. Tormented by guilt, Yaroch voluntarily confessed to the Justice Department and FBI in late July 2026, surrendering the seed phrase and a hardware wallet. He was immediately fired and arrested. He faces charges of interstate transportation of stolen property and receipt of stolen goods. The case highlights vulnerabilities within law enforcement, including excessive access to sensitive...

Author | Qin Xiaofeng, Odaily Planet Daily

Recently, a criminal complaint unsealed by the U.S. District Court for the Eastern District of Virginia has once again exposed the underbelly of American law enforcement.

Patrick Steven Yaroch, a former Federal Bureau of Investigation (FBI) supervisory special agent, is charged with abusing his official position to transfer nearly $1 million worth of cryptocurrency from accounts related to a 'hostile country' (one interpretation is 'Russia') under FBI surveillance into his personal wallets, and investing some of the funds on DeFi platforms to generate yield.

Perhaps due to inexperience, Yaroch even turned to ChatGPT for advice on how to handle the million dollars, plan for a European retirement, and booked a flight to Portugal. However, these plans ultimately fell through. Yaroch, 'consumed with guilt,' confessed to the FBI, bringing this internal corruption case involving cryptocurrency into the public eye.

The FBI has since terminated Yaroch's employment, emphasizing that the 'Bureau holds its employees to the highest ethical standards and such conduct will not be tolerated.'

This is not the first time a U.S. federal employee has exploited proximity to steal cryptocurrency—several federal agents similarly pocketed Bitcoin during the globally shocking 'Silk Road' investigation.

Case after case reminds people that the 'decentralized' myth of crypto assets is fragile in the face of unconstrained power. What truly needs repair is not the code of the blockchain, but the largely ineffective internal oversight mechanisms within the law enforcement system.

I. FBI Veteran Agent Transfers Assets by Memorizing Seed Phrases

Yaroch, now 37, had worked at the FBI's Boston field office since 2017, focusing extensively on national security investigations, particularly intelligence and counterintelligence operations against 'hostile countries.'

According to an affidavit submitted by a federal agent, Yaroch gained access to cryptocurrency accounts used by individuals connected to a 'hostile country' during his investigations.

The theft began in late 2024 or early 2025 while Yaroch was still at the Boston office. By accessing FBI internal systems, he obtained the seed phrases for the target crypto accounts. Instead of directly downloading or copying the file, Yaroch chose to memorize the words in his mind, subsequently creating a personal crypto wallet and gradually transferring the funds into it.

By his own admission, he conducted approximately 10 to 12 transfers; the funds eventually consolidated into a personal wallet he controlled, with a total value approaching $1 million.

Interestingly, he did not immediately cash out or move all the funds overseas. Instead, he commingled the stolen crypto assets with his personal funds. Some were held in a Kraken exchange account, while others were invested through a Slush wallet connected to the DeFi protocol Suilend to earn interest. He later explained that one reason for choosing Suilend was that he 'liked its water droplet shaped logo.'

In fact, as an FBI supervisory special agent, Yaroch held Top Secret and Sensitive Compartmented Information (SCI) clearances, and his administrative level was GS-14 (out of 15 grades), with an annual salary between $180,000 and $230,000. A mere million dollars did not seem like a colossal sum to him.

Initially, the FBI suspected Yaroch might have been compromised. However, he later explained to investigators that he had no direct interaction with the foreign entities or individuals associated with the accounts, and no evidence currently suggests otherwise.

Yaroch claimed he became increasingly frustrated by the FBI's 'inability or unwillingness to take action to disrupt the use of these accounts.' In his view, these assets were being used to support hostile activities, yet the FBI remained confined to intelligence gathering, unable to execute seizures or blockages. This sense of frustration, he claimed, was the starting point for his decision to 'take matters into his own hands.'

II. ChatGPT Serves as 'Financial Immigration Consultant'

On the surface, Yaroch's actions might seem driven by an 'idealistic' concern for his country. But the truth is far less noble, as ChatGPT conversation records extracted from his phone reveal another side.

On May 28, 2026, he inquired about how to invest or spend $1 million. On June 4, he further asked about the feasibility of 'leaving the U.S. with $1 million for a European country.' Based on his description—age 37, young family, desire to retire around 40, and preference for a slow-paced vineyard or agricultural lifestyle—ChatGPT recommended locations such as Italy's Cilento region or Portugal's Douro region, particularly endorsing Portugal as the top choice.

Concurrently, Yaroch booked flights from Washington to Lisbon/Porto for September 3–11, 2026, for himself, his wife, and child. He also signed a power of attorney authorizing a Portuguese lawyer (dated June 15, 2026) concerning tax identification numbers, customs, and financial matters, and personally went to a tax office to retrieve a password—typical preparatory steps for purchasing real estate or long-term residency. Furthermore, he made several overseas trips in 2026 that were not reported to the FBI, including a trip to Germany and Portugal in May and another to Grenada from late June to early July.

Prosecutors view these actions as potential signs of flight or asset transfer. Yaroch stated that all this was 'eating him up inside' and he wanted to 'get it off [his] chest.' On July 29, 2026, he voluntarily self-reported to the Department of Justice and the FBI, surrendering the seed phrase note, a Trezor hardware wallet, and other items. On July 31, the FBI immediately terminated his employment and executed his arrest.

On the day of his arrest, he even told an agent, 'I know I probably can't go anymore, but I hope my wife and kid can still go to Portugal as planned.'

Currently, Yaroch faces charges of interstate transportation of stolen property and receipt of stolen property. The case is still being heard in the Eastern District Court of Virginia.

III. Internal Corruption within the FBI?

This case is not complex but leaves many questions unanswered, also causing unease among many crypto holders.

First, the FBI's authority is excessive; merely being labeled a 'hostile country personnel' can land one on a watchlist. Even decentralized crypto assets are not safe from the FBI's reach, as they can 'steal' seed phrases through various informants or technical means. Note, these assets are self-custodied by users, not stored on exchanges, yet they still cannot escape the FBI's grasp, showing no real security.

Interestingly, last year, the U.S. Department of Justice charged and seized 127,000 BTC (worth approximately $15 billion at the time) from Chen Zhi, founder and chairman of Cambodia's Prince Group. These assets were previously held in non-custodial wallets controlled by Chen Zhi, with private keys in his possession, but the U.S. government still obtained the private keys through various means.

Second, there is a lack of effective oversight within U.S. federal agencies. Even highly sensitive data like seed phrases, serving as case evidence, are stored in the FBI's office systems and case files for investigating agents to access. Anyone who has seen a seed phrase, if their memory is sharp enough, could theoretically fly to a country with no extradition treaty, find an internet cafe, log into the wallet, and withdraw the funds.

Furthermore, the most bizarre aspect of this case is that the FBI, a world-class investigative agency, showed 'no awareness' that its internal data had been stolen.

When Yaroch transferred the $1 million from the wallet, the FBI's blockchain monitoring team likely captured this large transaction. However, FBI analysts might have habitually assumed it was a hostile entity laundering funds or consolidating assets internally to evade sanctions. They might have even updated their intelligence maps to track the new address's movements.

From start to finish, did no one suspect the money was embezzled by an insider? Or did everyone know but chose not to speak up? Before Yaroch's case was exposed, how many instances of such internal theft occurred? It's unknown. Perhaps this is the real 'business' of the 'Agent Smiths.'

Finally, a rather ironic point is that if Yaroch had not turned himself in, the FBI would likely never have caught him. After all, all the fund movements occurred on-chain, not tied to his real identity.

IV. A Common Sight: Federal Law Enforcement 'Exploiting Power for Personal Gain'

The 'Yaroch Case' is not an isolated incident. Looking back over the past decade, cases of U.S. federal law enforcement personnel exploiting their positions to obtain cryptocurrency are frequent, each causing significant attention.

The most famous cases occurred in 2015, related to the investigation of the darknet marketplace Silk Road. At that time, both U.S. Drug Enforcement Administration (DEA) special agent Carl Mark Force IV and U.S. Secret Service special agent Shaun W. Bridges were accused of stealing Bitcoin during the investigation.

Force, operating undercover, used a fake identity to communicate with Silk Road founder Ross Ulbricht, accepting and concealing cryptocurrency obtained during the investigation by transferring it into personal accounts. He also abused his authority to freeze assets in an exchange account and transferred approximately $300,000 into his own account, misappropriating over $700,000 worth of cryptocurrency in total. Force ultimately pleaded guilty and was sentenced to six and a half years in prison.

Bridges, after gaining control of Bitcoin related to Silk Road, transferred over 20,000 Bitcoin (worth $800,000 at the time) into the Mt. Gox exchange and then to a personal investment account, attempting to obscure the trail through complex transactions. Bridges was ultimately sentenced to 71 months for money laundering and obstruction of justice. In 2017, he received an additional 24 months for another case involving the theft of approximately 1,600 Bitcoin from a government wallet and was ordered to forfeit a large amount of Bitcoin.

These cases occurred in Bitcoin's early days when cryptocurrency regulation and tracking technologies were far less mature than today. Law enforcement personnel, upon obtaining private keys or account control, were highly susceptible to the temptation to take the funds. Similar to the Yaroch case, motives were often a mix of greed, dissatisfaction with case progress, and various rationalizations.

Conclusion

For the entire U.S. federal law enforcement apparatus, the occurrence of the Yaroch case reiterates that the anonymity and irreversibility of crypto assets pose a severe test for law enforcers themselves. Even under top-level clearances and supposedly rigorous internal system monitoring, human risk remains.

The weaknesses of human nature are often harder to guard against than any technical vulnerability. This near-million-dollar crypto theft case may well become a significant catalyst for future reforms in digital asset management within federal agencies.

Perguntas relacionadas

QWhat are the main charges against former FBI Special Agent Patrick Steven Yaroch according to the article?

APatrick Steven Yaroch is charged with interstate transportation of stolen property and receipt of stolen property, related to the theft of nearly $1 million in cryptocurrency from an account monitored by the FBI.

QHow did Yaroch access and transfer the cryptocurrency funds, according to the article's details?

AYaroch accessed the target cryptocurrency account's seed phrase through the FBI's internal system. He did not download or copy the file, but instead memorized the words with his brain. He then created a personal crypto wallet and gradually transferred the funds into it over approximately 10 to 12 transactions.

QWhat role did ChatGPT play in the events described in the article?

AYaroch used ChatGPT as a kind of 'financial immigration consultant.' He asked it how to invest or spend $1 million and, on another occasion, inquired about the feasibility of leaving the U.S. for a European country with that amount. ChatGPT recommended locations like Italy's Cilento or Portugal's Douro region, particularly endorsing Portugal as a top choice.

QWhat historical precedent for federal agents misappropriating cryptocurrency is mentioned in the article?

AThe article references the 'Silk Road' investigation case from 2015. In that case, U.S. Drug Enforcement Administration (DEA) Special Agent Carl Mark Force IV and U.S. Secret Service Special Agent Shaun W. Bridges were convicted of stealing Bitcoin during the investigation. Force misappropriated over $700,000, while Bridges stole more than 20,000 Bitcoin (worth $800,000 at the time).

QAccording to the article's analysis, what is presented as the broader systemic issue highlighted by the Yaroch case?

AThe article argues that the case highlights critical vulnerabilities within the law enforcement system itself. It points to the excessive power of agencies like the FBI to access self-custodied crypto assets, the lack of effective internal oversight for handling sensitive evidence like seed phrases, and the inherent human risk and potential for corruption, suggesting these are more pressing issues than any technical flaw in blockchain technology.

Leituras Relacionadas

Inside a Fake Ledger: How a 4G Modem is Secretly Embedded in a Hardware Wallet

In a presentation at Hardwear.io 2026, hardware security expert Joe Grand detailed a sophisticated spy chip discovered inside counterfeit Ledger Nano X hardware wallets. Initially reported in 2021, these tampered devices reached victims through data leaked from Ledger in 2020 and subsequent phishing campaigns. The implanted board connects to the internal SPI bus, passively intercepting data between the Secure Element and the OLED display. Using pattern recognition, it "reads" the seed phrase words displayed during wallet setup or recovery, stores them in its flash memory, and then exfiltrates the data via a built-in 4G modem and eSIM, independent of the victim's computer. To fit the extra hardware, the attackers reduced the battery size and replaced a thermal sensor with a fixed resistor to fake a 100% charge reading. Grand noted this is not an isolated incident, with similar supply-chain attacks previously targeting Trezor devices where compromised firmware generated predictable seed phrases. The researcher plans to intercept and decrypt the chip's cellular traffic to learn more about the attackers. Ledger advises users to purchase devices directly from the manufacturer or authorized resellers, not third-party marketplaces, and to compare devices against official photos. The company is also considering enhanced physical security for future products. The article questions whether Ledger Live's Secure Element authentication would detect such a passive hardware implant and highlights that the core risk lies in the physical supply chain, not just software.

cryptonews.ruHá 1h

Inside a Fake Ledger: How a 4G Modem is Secretly Embedded in a Hardware Wallet

cryptonews.ruHá 1h

Trading

Spot
活动图片