A former FBI counterintelligence agent has been charged with stealing nearly $1 million in cryptocurrency from wallets tied to an espionage-related matter he handled, according to case details cited by Foresight News. Patrick Steven Yaroch, 41, was arrested on July 31 at his home in Ashburn, Virginia. He faces two federal counts: transporting stolen goods across state lines and receiving stolen property. The FBI said it has recovered about $925,000.
What stands out in the case is not only how the money was moved, but how it came to light. Investigators did not first uncover the transfers through a routine probe, according to the affidavit. Yaroch contacted Justice Department personnel himself three days before his arrest and said he had made what he described as a terrible decision involving a crypto wallet. Investigators also recovered conversations from his phone showing that he had asked ChatGPT about early retirement, EU residency, and relocating to Europe.
Access to wallet information came through a counterintelligence case
Yaroch was a supervisory special agent with the FBI. He spent about eight years working on national security investigations in the Boston field office before moving in early 2025 to FBI headquarters, where he joined the counterintelligence and espionage section and received access to highly restricted intelligence systems.
By his own account to investigators, he came across crypto account information belonging to hostile foreign targets while working a counterintelligence matter in November 2024. He then began studying cryptocurrency, set up his own wallet, returned to FBI databases, and searched for information tied to those hostile crypto accounts. He memorized the seed phrases rather than storing them in a file or written note.
The affidavit says Yaroch told investigators that he “went into FBI systems” and found the keys needed to move the funds. He then transferred money from those hostile accounts into a wallet under his control in about 10 to 12 transactions, bringing the total to nearly $1 million. He also said he could not pin down the exact amount because the assets had been mixed with his personal investment gains, though he maintained the total was less than $1 million.
The language in the affidavit uses plural references, including “hostile accounts” and searches of FBI records relating to “hostile crypto accounts.” The identity of the foreign target and the country involved were redacted throughout the filing. The document does not explain how the recovery phrases were first obtained by the FBI or why they were stored in a searchable form that could be viewed in plain text.
The filing notes another detail: Yaroch referred to the seed phrase as a “passphrase,” and investigators added a footnote correcting the terminology. They also made clear that this was not a hacking case involving a software exploit or network intrusion. Once someone has the recovery phrase, they control the wallet. If the phrase is imported into wallet software, the blockchain records the transfer as a normal transaction.
Yaroch told investigators that he acted because he was frustrated that the government had not moved against the target’s crypto activity and decided to “take matters into his own hands.” He also said he never contacted anyone linked to the accounts and had not spent the money. The affidavit presents those statements as his own explanation.
Phone records showed questions to ChatGPT about retirement and relocation
After obtaining the funds, Yaroch appears to have started planning what came next. Conversations recovered from his phone from May and June showed that he asked ChatGPT how to retire before age 40 with $1 million and live at a vineyard in Italy or Portugal. He also asked about obtaining European Union residency and discussed Portugal in more detail in light of his family circumstances.
Investigators said those searches lined up with other steps he had taken. He had already booked flights for his family from Washington to Lisbon on Sept. 3, with a return on Sept. 11. In mid-June, he prepared a power of attorney so a Portuguese lawyer could help with tax and registration matters.
The filing also says Yaroch traveled this year to Germany, Portugal, and Grenada. Under the terms of his security clearance, those trips should have been reported, but investigators said he did not disclose any of them. When questioned, he denied planning to move the money overseas and said the Portugal trip was only to visit a friend.
Funds were traced to Kraken and Suilend
Investigators described the money trail as straightforward. About $188,500 was held in a Kraken account linked to a TD Bank account and accessed through Face ID on his phone. Another $1.02 million was moved in late July through an app called Slush into Suilend, a decentralized lending protocol on the Sui blockchain.
Asked why he chose Suilend, Yaroch said in remarks relayed by investigators that part of the reason was that he liked the project’s droplet-shaped logo. He also said he wanted to park the assets there and earn some yield. The affidavit notes that DeFi lending protocols leave permanent on-chain records, making the trail easier to follow once investigators tie a wallet to a person.
On July 31, with Yaroch’s consent, the FBI transferred about $925,000 from Kraken and Suilend into a government-controlled wallet. Another $165,500 remained at Kraken, but that portion had already been converted into U.S. dollars, so it could not be recovered through the same crypto transfer process.
He reached out before investigators came to him
According to the affidavit, Yaroch contacted a former colleague in the Justice Department’s National Security Division through Signal on the afternoon of July 28. They met at FBI headquarters around noon the next day. The filing says Yaroch became emotional during the meeting and admitted that he had made a terrible decision involving a crypto wallet, adding that the matter had been weighing on him and that he wanted to get it off his chest. He was told to get a lawyer and surrender immediately.
Later that same afternoon, he contacted FBI headquarters and asked for a meeting. He also submitted a self-report to the security division online. When he met with personnel, he again said he had messed up. Agents went to his Ashburn home that evening, suspended him, and collected government property.
During that encounter, Yaroch handed over a piece of paper containing the seed phrase, then withdrew his consent minutes later and took it back, according to the filing. He repeatedly said, “I messed up,” and then invoked his right to remain silent. The FBI formally fired him on July 31. That same day, after he helped move the funds back to a government wallet, agents arrested him.
Yaroch said he confessed because he was ashamed and knew he had done wrong. The affidavit does not draw a conclusion on whether the confession was driven by conscience, fear of an approaching investigation, or both.
What the case highlights
The affidavit shows how digital conversations can end up in an evidence file. Questions Yaroch asked ChatGPT about retirement, immigration, and potential destinations were each folded into the case record.
The filing also raises questions about how sensitive crypto credentials were stored. Based on the material that has been made public, FBI databases contained wallet recovery phrases tied to hostile foreign targets, and an agent was able to search them, memorize them, and move nearly $1 million without detection for more than a year. The affidavit does not explain why those phrases were stored in that form or what internal controls existed around access and alerts.