VULNpocalypse
InformationalBreach / campaignMonitoring

BleepingComputer reports ex-FBI agent pleaded guilty to $2.5M crypto theft

BleepingComputer reports a former FBI agent pleaded guilty to taking about $2.5M in crypto from wallets in FBI cases, no patch or fix is involved.

Published
Updated
Exploitation
No software exploit reported. BleepingComputer says the defendant used wallet passphrases obtained from FBI systems, and cites court documents and the Justice Department.

What happened

According to BleepingComputer, a former FBI agent, named as 37-year-old Patrick Steven Yaroch, has pleaded guilty to wire fraud and money laundering charges. BleepingComputer reports that he admitted stealing nearly $2.5 million from the wallets of fraud victims and nation-state hackers under investigation. This is the account of one outlet, which cites court documents and a Justice Department statement. This advisory has not checked it against those documents.

BleepingComputer reports the following:

  • He worked on a national security investigative squad at the FBI Boston Division from 2017 to 2025, and as a supervisory special agent in the FBI Headquarters Counterintelligence and Espionage Division between February 2025 and July 2026.
  • He admitted using passphrases obtained from the FBI’s case management systems and another platform used to share investigative data. He used them to move funds from wallets of fraud victims or suspects under FBI investigation into his own wallets.
  • BleepingComputer says that, according to court documents, he then tried to launder the funds by exchanging them for other cryptocurrencies.
  • BleepingComputer quotes the Justice Department as saying he made approximately 100 fraudulent transfers using credentials related to 35 separate FBI investigations, gaining approximately $2,474,380.66.
  • BleepingComputer says he self-reported the theft on July 29, was arrested on July 31, and was fired by the FBI on July 31, 2026, after being placed on administrative leave on July 29.
  • BleepingComputer says prosecutors added that his actions compromised multiple FBI investigations involving nation-state adversaries and criminal groups, as well as FBI sources and methods.
  • BleepingComputer says he is scheduled to be sentenced on March 4, facing up to 20 years in prison for wire fraud and up to 20 years for money laundering.

Not confirmed in the sources provided: which investigations or wallet owners were affected, whether the funds have been recovered, and how the FBI systems controlled access to the passphrases. The Justice Department statement and court documents are quoted by BleepingComputer, and no direct link to them was provided here.

Am I affected?

The sources describe no software vulnerability, no CVE and no product to patch. Based on BleepingComputer’s report, the only people potentially affected are those whose wallet credentials were held in FBI case systems or a related investigative data-sharing platform. The sources do not name those victims or suspects, and they do not say whether any notifications have been made. Whether any particular person is affected is not confirmed.

What to do now

  1. If you are a victim or party in an FBI case that involved cryptocurrency, contact the case agent or the agency to ask whether your wallet credentials were affected. The sources do not say whether such notifications are being sent.
  2. If you have handed wallet passphrases or seed phrases to any third party, including investigators, consider moving funds to a new wallet. This is editorial suggestion, not something stated in the sources.
  3. Watch for the sentencing, scheduled for March 4 according to BleepingComputer, and for any official statement on affected investigations.

Update, 12 November 2026

  • Malwarebytes reports that the guilty plea was entered on November 5, and that, citing the FBI’s search affidavit, the transfers began no later than December 2024. It says he memorized the seed phrases after accessing them in FBI systems.
  • Per the affidavit as reported by Malwarebytes, he asked ChatGPT how to invest a million dollars and where to live in Europe, and began setting up a life in Portugal.
  • Malwarebytes says he first confessed to a former DOJ colleague, who urged him to self-report. It says agents then executed a warrant at his home and seized assets, including a phone with access to a Kraken account and a paper with seed phrases for his own account.
  • Malwarebytes says the affidavit gives frustration at the pace of FBI action as his stated reason, and that the DOJ says he used some proceeds for personal debts.
  • Malwarebytes also points to earlier cases: a former Secret Service agent who pleaded guilty in December 2024 over $56,000 taken from a hardware wallet in an evidence vault, and another who pleaded guilty in 2015 over bitcoin taken during the Silk Road investigation.
  • These details come from Malwarebytes alone and have not been checked against the affidavit or DOJ documents.

Sources