Former FBI agent pleads guilty to stealing and laundering about $2.47 million in crypto
Patrick Steven Yaroch pleaded guilty to wire fraud and money laundering after using his access to FBI systems holding cryptocurrency credentials from investigations, the U.S. Attorney's Office for the Eastern District of Virginia said.
A former FBI agent from Ashburn, Virginia, pleaded guilty on 5 November 2026 to wire fraud and money laundering, the U.S. Attorney's Office for the Eastern District of Virginia said. According to court documents, Patrick Steven Yaroch, 37, used his access to FBI systems to steal cryptocurrency. Those systems held cryptocurrency credentials that the FBI had collected as part of its investigations.
According to court documents, Yaroch worked at the FBI Boston Division from 2017 through early 2025 on an investigative squad focused on an adversarial nation state, and from February 2025 to 31 July 2026 in the FBI's Counterintelligence and Espionage Division. Beginning no later than December 2024, he stole cryptocurrency from wallets controlled by the subjects of other investigations or by adversarial nation state actors, and from at least one wallet the FBI created to use in an operation. The office said he made approximately 100 fraudulent transfers using credentials related to 35 separate FBI investigations, and gained approximately $2,474,380.66 in fraudulent proceeds.
According to the office, Yaroch exchanged the stolen cryptocurrency for a different type of cryptocurrency, then laundered it through further transactions to hide its source, nature and ownership. Between 25 November 2025 and 13 January 2026, he transferred approximately $93,082 to one of his accounts and then moved the funds between his other accounts, from which he paid debts including credit cards, car payments and other loans. The office said he also intended to use the proceeds to finance a new life abroad. After ChatGPT suggested buying a vineyard in Portugal, he gave lawyers in Portugal a power of attorney on 15 June 2026 to represent him before the Portuguese Tax and Customs Authority and register him for a tax identification number, and he arranged to travel to Portugal in September 2026.
According to the agreed statement of facts, Yaroch's actions compromised multiple FBI investigations related to criminal groups and nation state adversaries, and compromised FBI sources and methods. U.S. District Judge Patricia Tolliver Giles accepted the plea. Yaroch is scheduled to be sentenced on 4 March 2027 and faces up to 20 years in prison. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.
Why it matters to AML professionals
Insiders with privileged access to keys, credentials or customer data can move value without triggering the controls built for outside attackers. The laundering steps described here, swapping one crypto asset for another and then layering funds through several personal accounts before paying debts, are common patterns that transaction monitoring and blockchain analytics are meant to catch. AML professionals at firms that hold or can reach crypto credentials should treat access rights and unusual staff-linked transfers as part of the financial crime risk picture.
Red flags in this case
- Crypto received from an unfamiliar source and swapped into a different token soon after arrival
- Funds passed between several accounts held by the same customer before being used for personal spending
- Large debt repayments, such as credit card and car loan payments, funded by crypto inflows that do not match the customer's known income
- Unexplained crypto inflows followed by arrangements to move, invest or register for tax abroad
If this landed in your queue
- Trace the crypto inflows on-chain and screen the source addresses with blockchain analytics for links to theft, seizure or law enforcement wallets
- Compare the size and pattern of inflows with the customer's stated occupation and expected income
- Map transfers between the customer's own accounts and document the final use of the funds
- Escalate the case and file a suspicious activity report if the source of the funds cannot be explained
What control failed
Insider misconduct. According to court documents, Yaroch used his access to FBI systems containing cryptocurrency credentials collected in investigations to steal cryptocurrency from wallets linked to 35 separate FBI investigations.
Key terms
- Insider threat
- Risk that a person with legitimate access to systems or assets misuses that access to steal, leak or cause harm.
- Layering
- The money laundering stage where funds are moved through several transactions or accounts to hide where they came from.
- Statement of facts
- A written account of the conduct that a defendant agrees is true as part of a guilty plea.
Interview angle
How would you detect an insider who uses privileged access to steal crypto and then launder it?
Cover both sides: access controls and logging on who can reach keys or credentials, and monitoring of staff-linked or customer accounts for token swaps, movement between own accounts and debt repayments that do not fit known income. Mention blockchain tracing and escalation through a SAR.
Sources
Go deeper on AMLift
Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.
Report an error
Every report is checked against the official source. If we got something wrong, the story is corrected.