---

Federal prosecutors charged FBI Supervisory Special Agent Patrick Steven Yaroch on August 3, 2026, with stealing approximately $1 million in cryptocurrency from wallets tied to a Russia-linked investigation. Yaroch, who held a top-secret security clearance and worked at an FBI satellite facility in Ashburn, Virginia, allegedly executed 10 to 12 unauthorized transfers between late 2024 and July 2026. On July 28, 2026, he first disclosed the theft to a colleague, then separately self-reported to DOJ colleagues. A federal magistrate ordered his temporary detention the same day as his arrest.

Investigators recovered $925,426.07, the bulk of the stolen funds, through seizures from crypto accounts and wallets. Yaroch faces charges of interstate transportation of stolen goods and receipt of stolen goods, securities, and money. He was fired from the bureau on July 31, three days before his arrest.

How He Did It

Yaroch's position in the FBI's Counterintelligence and Espionage Division gave him lawful access to internal systems containing private keys and passphrases for cryptocurrency wallets under active investigation. According to the court affidavit cited by NBC News, he became frustrated that the FBI "could not or would not act against adversarial cryptocurrency accounts" and decided to move the funds himself. Court documents refer to the wallets as belonging to an "adversarial nation," identified as Russia in NBC News reporting. He created his own wallet, queried bureau systems for credentials, and began transferring USDC (a dollar-pegged stablecoin issued by Circle) out of the target wallets.

His platform choices reflected carelessness rather than any deliberate planning. He routed roughly $1 million to Suilend, a decentralized lending protocol built on the Sui blockchain, possibly intending to put the funds to work earning DeFi yield. Court documents note he selected Suilend for a strikingly casual reason: he liked that the logo was a water droplet. He also moved funds through Kraken, a centralized exchange, where investigators seized $188,570.58. The remainder was held in a Slush wallet, Sui's official browser extension.

Yaroch's exit plan was documented in his ChatGPT search history, which prosecutors recovered as forensic evidence. He asked the AI how to invest $1 million and relocate to an EU country, prompting a recommendation of Portugal. He had already booked a September 3 flight for himself and his family before confessing. He later described his actions to DOJ colleagues as "very poor decisions related to cryptocurrency wallets," and the affidavit noted it "was eating him up inside and he wanted to get it off his chest."

A Known Structural Problem

The case highlights a custody gap that cybersecurity practitioners have flagged for years. The U.S. government seized more than $15 billion in cryptocurrency in 2025 alone, through operations including the takedown of Garantex, a Russian exchange that processed hundreds of millions in criminal proceeds. Yet federal agencies typically hold seized crypto through single-administrator access points rather than multisig arrangements, where multiple independent parties must authorize any transaction. In contrast, one 2026 industry analysis found that 94% of institutions managing more than $50 million in digital assets now use multisig custody. Threshold signature schemes and Shamir Secret Sharing are established alternatives that would have made Yaroch's transfers structurally impossible without additional authorization.

This vulnerability is not new. A UK law enforcement officer previously stole approximately 50 BTC from Silk Road 2.0 seized assets using mixing services, an earlier case of insider-custody abuse that illustrates the same structural weakness Yaroch's case now puts back under the spotlight.

The FBI responded with a brief statement: "The individual has since been fired from the Bureau. We hold our employees to the highest ethical standards, and this conduct is not tolerated at the FBI."

Regional Exposure: Africa and Beyond

The wallets Yaroch accessed were part of an active investigation into Russian sanctions evasion, a category of activity that extends well beyond U.S. borders. The EU's 21st sanctions package, issued in July 2026, targeted a $120 billion Russian crypto evasion network and named 14 specific platforms for prohibition, including Rapira, HTX, and EXMO. Among the named entities were A7 Nigeria and A7 Africa, subsidiaries of a Russian stablecoin payment network that processed $93.3 billion in transactions across Nigerian and Zimbabwean corridors in just 10 months, per the Africa Defense Forum.

The parallel is uncomfortable. U.S. law enforcement was simultaneously investigating these networks and, through Yaroch, providing an internal pathway through which funds could be diverted. For Nigerian and other African regulators deepening crypto oversight frameworks, the case introduces a practical question: if seized or monitored funds can be moved unilaterally by a single authorized insider, how much weight should compliance programs place on U.S. intelligence-sharing arrangements without independent verification?

What Comes Next

The Yaroch case will likely sharpen policy conversations on two fronts. First, the use of a DeFi protocol in a law enforcement insider-theft case appears to be without public precedent, and observers expect regulators may cite it when pressing for stricter KYC (know-your-customer) requirements on decentralized platforms. Second, the successful recovery of nearly all funds via USDC's on-chain traceability underscores the forensic value of stablecoins, while also reinforcing that Circle's freeze authority over USDC makes the asset poorly suited for long-term evasion. Yaroch's case is filed in the Eastern District of Virginia, where Magistrate Judge Lindsey R. Vaala ordered his temporary detention at arrest; the matter is expected to be assigned to a district judge as it proceeds to trial.