Patrick Steven Yaroch, an FBI agent who worked for the bureau from February 2025 through July 2026, has been charged with stealing more than $900,000 in cryptocurrency from accounts the agency was monitoring, according to court records made public on August 3. Yaroch allegedly used his internal access to transfer the holdings to his personal accounts after growing frustrated by what he saw as government inaction over the misuse of crypto accounts.
According to an affidavit filed by another FBI special agent, Yaroch came across the crypto holdings while serving on the FBI’s national security investigative squad focused on an unnamed adversarial nation. When he could not do more to disrupt what he viewed as criminal use of those accounts, he took matters into his own hands, transferring the cryptocurrency to accounts he controlled, including approximately $188,570 on the exchange Kraken and roughly $1 million moved to Suilend.
The FBI fired Yaroch and arrested him last week. A criminal complaint lists charges related to the interstate transport of stolen goods and receipt of stolen goods. When interviewed by FBI agents at his residence in July, Yaroch acknowledged his actions, telling agents “I f—d up,” according to the affidavit. He later confided to a former colleague from the FBI’s Boston Division that the theft was “eating him up inside,” prompting him to contact FBI headquarters on July 29 to set up a meeting to discuss what he had done.
The case reveals how artificial intelligence and cryptocurrency are reshaping criminal investigations. In the month before his arrest, Yaroch asked ChatGPT: “If you had a bucket of money (around $1 million) and you wanted to leave the USA and become a resident or citizen of an EU country, what would you do?” ChatGPT responded with detailed suggestions tailored to Yaroch’s age and lifestyle, recommending Portugal as his best option. The FBI found evidence of an upcoming trip Yaroch had planned to Portugal. When confronted, he told agents he was not planning to funnel money into Portugal, though he acknowledged he would no longer be allowed to visit and hoped his wife and child could still go on the trip.
When the FBI obtained Yaroch’s cell phone, they also discovered he had asked ChatGPT: “If I had a million dollars, how would you suggest investing it/spending it to maximize profit and return.” The affidavit notes that Yaroch told FBI agents he chose Suilend to receive the transferred funds simply because he liked that the logo was a water droplet.
A Pattern of Government Crypto Custody Failures
Yaroch’s case is not the first time a person with access to government-held cryptocurrency has stolen from it. In March 2026, John Daghita, the son of a federal contractor running a cryptocurrency custody company called CMDSS, was arrested in Saint Martin after allegedly stealing more than $46 million in cryptocurrency from seizure wallets managed by the U.S. Marshals Service. According to a federal indictment, Daghita had spent three months moving the assets into wallets only he controlled, then laundered the funds through Tornado Cash, a cryptocurrency mixer designed to obscure transaction origins.
The Daghita case exposed systemic vulnerabilities in how the U.S. government manages seized cryptocurrency. Per a 2022 audit by the DOJ’s Office of Inspector General, the Marshals Service’s policies related to asset storage, quantification, valuation, and disposal were inadequate or absent, and inventory was tracked in supplemental spreadsheets that could be edited or deleted without a record. The audit warned that without properly documented policies and procedures, the agency lacked an adequate foundation for building performance requirements for a cryptocurrency services contract.
The structural vulnerability that enabled the Daghita theft was the absence of genuine multi-signature controls—a security measure requiring independent authorization from multiple key holders before cryptocurrency can be transferred. According to forensic analysis of the case, the Trezor hardware wallets recovered at Daghita’s villa confirmed a single-signer model, meaning one person could unilaterally move government assets.
An FBI spokesperson told CNN that the bureau holds its employees to the highest ethical standards and that this conduct is not tolerated. “As soon as the FBI became aware of these allegations, we immediately took action, began an investigation, and ultimately executed an arrest warrant for this individual last week,” the spokesperson said. The FBI is conducting a thorough investigation in the aftermath of Yaroch’s arrest.
Sources
- CNN — Yaroch’s theft of $900,000 in cryptocurrency, his frustration over government inaction, ChatGPT conversations, arrest, and FBI statement
- Protos — Yaroch’s employment dates (February 2025 to July 2026), charges of receipt of stolen goods and interstate transport, wallet amounts, and Suilend transfer details
- Forbes — John Daghita’s $46 million theft from U.S. Marshals Service, the multi-signature control vulnerability, 2022 OIG audit findings, and procurement failures
