Blab Crypto
FBI Insider Arrested After Alleged $1 Million Crypto Theft From Adversarial Wallets
On March 4, 2026, the Federal Bureau of Investigation (FBI) fired and arrested Patrick Steven Yaroch, a former Ashburn, Virginia employee, after an internal probe revealed that he had used classified data to siphon cryptocurrency from foreign accounts. The FBI’s affidavit says Yaroch, who held a top‑secret clearance, confessed to a colleague on July 28, 2025 that he had repeatedly taken funds from “adversarial” crypto wallets.
Yaroch had been stationed on the FBI’s national security and counterintelligence team in Boston, where he investigated a target linked to a U.S. adversary. According to the affidavit, frustration over his inability to disrupt the target’s crypto activity led him to create a personal wallet in late 2024. He then combed the agency’s systems for passphrases tied to adversarial accounts and moved roughly $1 million in cryptocurrency into his own wallet across 10 to 12 transactions.
Although Yaroch claimed he never spent the money, the affidavit records that he repeatedly asked the artificial‑intelligence chatbot ChatGPT for guidance on how to use the funds, including how to invest them for maximum return and how to relocate to an EU country. ChatGPT suggested Portugal as a retirement destination, and Yaroch also sought advice on visa requirements for Turkey and drafted an email about a job in Greece.
Investigators uncovered evidence of undisclosed international travel. Between May and July 2026, Yaroch booked flights for himself, his wife and child to Portugal, Germany and Grenada—destinations he was required to report under federal travel regulations. He also obtained power‑of‑attorney documents for two lawyers in Portugal and instructions to obtain a Portuguese tax identification number.
On the day of his arrest, FBI agents seized $925,426.07 from Yaroch’s cryptocurrency wallets and bank accounts during a search of his home. He was charged with interstate transportation of stolen goods, securities and monies, and receipt of stolen goods, securities and monies.
The case underscores the growing risk of insider theft in the crypto sector. It is the first public record of an employee using classified data to facilitate a large‑scale crypto theft, according to the FBI’s affidavit. The agency has not released details on how the funds were moved on the blockchain, nor whether the stolen assets have been recovered.
Yaroch’s removal from the FBI and the subsequent charges demonstrate the agency’s enforcement of internal security protocols. The incident also raises questions about safeguards for employees with access to sensitive financial data.
No court proceedings have been announced yet, and the FBI has not disclosed whether the stolen cryptocurrency has been traced to a specific wallet address or whether any of the assets have been recovered. The investigation remains ongoing.
Regulators and industry participants are watching closely, concerned that similar insider attacks could erode confidence in the security of crypto transactions. The FBI’s action serves as a reminder that employees with access to classified information must adhere to strict security protocols, and violations can lead to immediate termination and criminal prosecution.
The investigation is active, and further details are expected as the FBI continues to analyze the extent of the theft and the methods used to move the funds.
Yaroch had been stationed on the FBI’s national security and counterintelligence team in Boston, where he investigated a target linked to a U.S. adversary. According to the affidavit, frustration over his inability to disrupt the target’s crypto activity led him to create a personal wallet in late 2024. He then combed the agency’s systems for passphrases tied to adversarial accounts and moved roughly $1 million in cryptocurrency into his own wallet across 10 to 12 transactions.
Although Yaroch claimed he never spent the money, the affidavit records that he repeatedly asked the artificial‑intelligence chatbot ChatGPT for guidance on how to use the funds, including how to invest them for maximum return and how to relocate to an EU country. ChatGPT suggested Portugal as a retirement destination, and Yaroch also sought advice on visa requirements for Turkey and drafted an email about a job in Greece.
Investigators uncovered evidence of undisclosed international travel. Between May and July 2026, Yaroch booked flights for himself, his wife and child to Portugal, Germany and Grenada—destinations he was required to report under federal travel regulations. He also obtained power‑of‑attorney documents for two lawyers in Portugal and instructions to obtain a Portuguese tax identification number.
On the day of his arrest, FBI agents seized $925,426.07 from Yaroch’s cryptocurrency wallets and bank accounts during a search of his home. He was charged with interstate transportation of stolen goods, securities and monies, and receipt of stolen goods, securities and monies.
The case underscores the growing risk of insider theft in the crypto sector. It is the first public record of an employee using classified data to facilitate a large‑scale crypto theft, according to the FBI’s affidavit. The agency has not released details on how the funds were moved on the blockchain, nor whether the stolen assets have been recovered.
Yaroch’s removal from the FBI and the subsequent charges demonstrate the agency’s enforcement of internal security protocols. The incident also raises questions about safeguards for employees with access to sensitive financial data.
No court proceedings have been announced yet, and the FBI has not disclosed whether the stolen cryptocurrency has been traced to a specific wallet address or whether any of the assets have been recovered. The investigation remains ongoing.
Regulators and industry participants are watching closely, concerned that similar insider attacks could erode confidence in the security of crypto transactions. The FBI’s action serves as a reminder that employees with access to classified information must adhere to strict security protocols, and violations can lead to immediate termination and criminal prosecution.
The investigation is active, and further details are expected as the FBI continues to analyze the extent of the theft and the methods used to move the funds.
