Former FBI agent Patrick Steven Yaroch pleaded guilty on November 5 to wire fraud and money laundering after stealing approximately $2.47 million in cryptocurrency, according to the Justice Department. Prosecutors said he made about 100 fraudulent transfers using credentials related to 35 FBI investigations.
The affected wallets included accounts controlled by investigative subjects and adversarial nation-state actors, plus at least one wallet created for an FBI operation. The reported total therefore included funds stolen from outside bureau-owned wallets. Yaroch used his investigative access to obtain control over those funds.
Investigative records became spending credentials
The earlier affidavit, filed August 1 in the Eastern District of Virginia, describes the mechanism. Investigators said Yaroch searched FBI holdings, memorized wallet recovery phrases and used them to transfer cryptocurrency into a personal wallet.
That sequence exposes a specific custody problem. A record containing a recovery phrase can give its reader the means to move assets. Permission to examine investigative material therefore carries a financial risk when that material includes usable wallet credentials.
For an organization designing access controls, the relevant question is whether someone who needs to read a case file also needs access to the secret that controls its funds. Those permissions deserve separate treatment. Restricting a transfer interface would provide little protection if an employee could obtain the recovery phrase elsewhere.
The affidavit also describes investigators recovering handwritten wallet phrases from Yaroch's home. During the subsequent recovery process, agents used phrases found in the search to move cryptocurrency into government-controlled wallets.
The same kind of information enabled transfers in both directions. Its handling deserves the attention normally given to the assets themselves.
The initial account understated the eventual scope
The August affidavit recorded Yaroch's initial account of roughly 10 transfers and holdings around $1 million. The November plea announcement described about 100 transfers and $2.47 million in proceeds. Those figures belong to different stages of the case; the plea announcement provides the later account.
The expanded scope also changes the security analysis. A single unauthorized transfer might prompt a review of one wallet and one employee's access. Repeated transfers using credentials from separate investigations require a broader review of access to those records.
In SpendNode's assessment, a useful review would connect document access with subsequent wallet activity. Reviewing either in isolation leaves a gap: an employee may have permission to open a record while having no authority to spend from the wallet described in it. The review needs to test both permissions.
The affidavit says agents transferred approximately $925,426 in cryptocurrency to government-controlled wallets on July 31. That recovery figure predates the accounting of the eventual $2.47 million total and should not be used to calculate a final recovery rate.
Custody controls have to account for insiders
The Justice Department said Yaroch's actions compromised multiple investigations and FBI sources and methods. The damage therefore extended beyond the balance of the affected wallets.
For a team managing investigative funds, an unauthorized transaction creates two separate tasks: tracing the assets and assessing the effect on the operation. Recovering money addresses only the first. A transaction made outside the investigation's plan may also require investigators to reconsider their work.
The practical custody lesson is to map every place a usable secret can appear. A wallet may have a carefully controlled signing process while its recovery material sits in records accessible to a wider group. In that arrangement, the recovery material becomes another route to control.
A stronger design would limit access to complete recovery material and require separate approval for moving operational funds. Access reviews should include copies of credentials retained in case records, alongside the wallet tools used by authorized operators. These recommendations follow from the reported mechanism.
For readers considering keeping control of their own wallet, the same distinction applies at a smaller scale. Choosing who holds the keys includes deciding who can read the backup. Sharing a recovery phrase gives another person the ability to control the wallet.
An institution's country, including the United States, does not answer that operational question. The useful details are who can obtain the secret and whether moving funds requires another person's approval.
Overview
Yaroch's guilty plea established a $2.47 million theft involving credentials from 35 investigations, including an FBI operational wallet. The case illustrates the financial authority embedded in investigative records containing wallet secrets. Sentencing is scheduled for March 4, 2027; prosecutors said he faces up to 20 years in prison.
