A 41-year-old former FBI counterintelligence agent has been charged with stealing nearly $1 million in cryptocurrency from an adversary's wallet in a spy case he was handling himself. His method involved memorizing the wallet's seed phrase, leaving no paper trail, and transferring the funds to his own account approximately 10 to 12 times over a year without being detected. On July 31, he was arrested at his home in Ashburn, Virginia, facing federal charges of "interstate transportation of stolen property" and "receipt of stolen property," with the FBI having recovered approximately $925,000.
One of the most intriguing aspects of this case is how a former agent exposed himself, which added a unique twist: he didn't get caught; he turned himself in. Three days earlier, he arranged to meet with Department of Justice officials via Signal, and as soon as they sat down, he confessed, stating that he had made a "terrible decision regarding the cryptocurrency wallet" and that it had been "haunting him." What is even more absurd is that authorities discovered he had sought advice from ChatGPT on his escape plan on his phone.
From Spy Catcher to Self-Thief
The defendant, Patrick Steven Yaroch, 41, is an FBI Supervisory Special Agent. He spent approximately eight years in the Boston field office conducting national security investigations before transferring to FBI headquarters in early 2025, joining the Counterintelligence and Espionage Division, where he obtained access to highly restricted intelligence systems.
According to his confession to investigators, in November 2024, while working on a counterintelligence case, he came into contact with an adversary's crypto account. He then went beyond mere "contact": he researched cryptocurrencies, created his own wallet, and then went back to the FBI's database to retrieve information about the adversary's crypto account, memorizing the seed phrases one by one.
In his affidavit, he was even more candid—he "got into the FBI system, found the key needed for the transfer." Subsequently, he made around 10 to 12 transfers from these adversary accounts, moving the money into his own wallet, totaling nearly $1 million. He claimed he wasn't exactly sure of the precise amount because it got mixed up with his personal investment returns, but it was definitely under a million.
Two details are worth noting here. First, the affidavit consistently used the plural form—"adversary accounts," "retrieved information from the FBI database about adversary crypto accounts." In other words, the FBI's database contained credentials for more than one target wallet, and a single agent could directly retrieve and view plaintext seed phrases. What he could steal theoretically involved more than just one person. Second, the investigator purposely added a footnote to correct him: Yaroch had referred to the seed phrase as a "passphrase," which was incorrect. This indicates that although Yaroch was involved in counterintelligence, he had only a partial understanding of cryptographic terms.
Investigators also pointed out that this was not some sophisticated hacking technique; there were no loopholes, no attacks. Possessing the mnemonic phrase was equivalent to possessing the wallet. Entering the phrase into any wallet software would appear as a normal transaction on the blockchain, making it impossible for the network to distinguish the true owner from the key holder.
As for how these hostile mnemonic phrases initially made their way into the FBI's database and why they were stored in a retrievable and portable format, the affidavit did not disclose this information, keeping the identities of the foreign targets and their countries confidential throughout the entire process.
Yaroch justified his actions by stating that he was fed up with the government's inaction regarding the encrypted activities of this target. He decided to take matters into his own hands. He also emphasized that he had never contacted anyone associated with these accounts and that the money had remained untouched. However, these are all his unilateral claims.
Desiring to Retire Before 40 and Grow Grapes in Portugal
Once he had the money, he began to plan the rest of his life. However, this counterintelligence expert shared his step-by-step planning process with ChatGPT.
Text messages recovered from his phone in May and June revealed that he had inquired about how to retire before the age of 40 with $1 million, move to Italy or Portugal to live on a vineyard, and also asked about obtaining EU residency, specifically discussing Portugal based on his family situation.
All the pieces fit together: the family flew from Washington to Lisbon on September 3rd, and return tickets for September 11th were already booked. In mid-June, he prepared a power of attorney document to have a Portuguese lawyer handle his tax affairs and registration. Investigators also discovered that he had traveled to Germany, Portugal, and Grenada this year. According to security clearance regulations, these trips should have been reported, but he had never reported any of them. When questioned, he adamantly claimed that he had no intention of transferring the money overseas and stated that his trip to Portugal was merely to visit a friend.
Transferring Money to Suilend Due to Liking the Logo
The way Yaroch moved the funds was not particularly discreet. Approximately $188,500 was placed in a Kraken account linked to a TD Bank account, accessed using facial recognition on his phone. In late July, another $1.02 million was transferred through an app called Slush into Suilend, a decentralized lending protocol on the Sui chain.
The reason for choosing Suilend was also quite absurd. As recounted by investigators, he mentioned that partly it was because he liked the water droplet-shaped logo. He decided to earn some interest by depositing the money there and letting it sit. However, DeFi lending protocols leave permanent on-chain records, and once the wallet ownership is traced, it provides a clear path for investigation.
On July 31, with his consent, the FBI transferred approximately $925,000 from Kraken and Suilend to a government-controlled wallet. An additional $165,000 remained in Kraken—this portion had already been converted to USD and could not be recovered through the same cryptocurrency transfer process.
He Didn't Wait for the Investigation to Knock on His Door, Instead Contacted the Department of Justice
In the afternoon of July 28, Yaroch proactively reached out to a former colleague at the Department of Justice's National Security Division via Signal and met at the FBI headquarters the next day at noon. According to a sworn statement, upon meeting, he became emotional, admitted to making a terrible decision regarding the cryptocurrency wallet, expressed that the situation had been tormenting him, and he wanted to "get it off his chest"; he was advised to promptly seek legal counsel and surrender himself.
Later that afternoon, he voluntarily contacted the FBI headquarters to request a meeting and submitted a self-report online to the security agency, admitting that he had "messed up." That evening, agents arrived at his Ashburn home, suspended him from duty, and confiscated government property. During this time, he handed over a paper with the recovery phrase but quickly retracted his consent, only repeating, "I messed up," and later invoked his right to remain silent. On July 31, the FBI officially terminated his employment; on the same day, after he cooperated in returning the funds to the government wallet, agents arrested him on the spot.
He explained his self-reporting as stemming from remorse and knowing he had done wrong. As for whether this was due to a guilty conscience or a preemptive confession upon sensing an impending investigation, the sworn statement did not draw a conclusion and it is not necessary to judge on his behalf.
What This Case Reminds Ordinary People
Firstly, chat records can truly become evidence. Yaroch's conversations with ChatGPT—regarding retirement, immigration, and vineyards—all ended up in the case file. What you may think is just casual conversation, is actually not to be taken lightly.
Secondly, something the industry should ponder further: within the FBI's database, the recovery phrase for an adversary's wallet was stored in plaintext, allowing an agent to directly access and transfer out nearly a million dollars without triggering any alerts for over a year. Ultimately, it was his guilty conscience that led to his confession. While we discuss the security of cryptocurrency assets, focusing on whether exchanges are secure or if cold wallets are at risk, we rarely consider the lax security measures around evidence held by law enforcement. How did these recovery phrases initially end up in the FBI's vault in a format that could be memorized by a single individual?
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
