FBI Agent Crypto Theft: One Password, No Hack Needed

Prosecutors say Patrick Yaroch, a Supervisory Special Agent in the FBI's counterintelligence division, pulled off an FBI agent crypto theft that needed no hacking at all: he used a passphrase he'd memorized from an internal FBI database to move roughly $1 million in cryptocurrency out of wallets tied to an investigation into an adversarial nation — widely reported as Russia — and into his own control. The transfers ran in roughly 10 to 12 batches from around November 2024 into early 2025. He was arrested July 31, 2026, at his Virginia home, and charged by criminal complaint filed August 1 in the Eastern District of Virginia (Alexandria); he has already had his initial court appearance and a detention hearing this week. By July 31, the government says it had already clawed back about $925,000 of the roughly $1 million taken — around 93% — from Kraken and from the DeFi platform where Yaroch had parked the funds.

That recovery rate reads like a success story. It isn't the real story. The real story is how little it took to pull this off, and how long nobody noticed.

There was no exploit, no phishing, no zero-day. Yaroch had legitimate database access as part of his job, and the wallets in question held crypto seized as evidence in an active investigation — not yet forfeited, not yet locked in cold storage under formal custody procedures. He simply remembered the passphrase and used it. That's the detail worth sitting with: a Top Secret-cleared federal agent looking at evidence-stage crypto had, functionally, the same access to it as its owner would. No second factor, no hardware key, no rule requiring the passphrase to live somewhere he couldn't just carry out of the building in his head.

This matters because most public debate about government crypto custody has focused on assets that already cleared the courts and sit in formal forfeiture — the multibillion-dollar Bitcoin holdings the US Marshals Service manages and periodically auctions. Those get scrutiny. What this case shows is that the weaker link may sit earlier in the pipeline, while crypto is still evidence, moving through fewer hands and fewer controls before anyone has even decided what happens to it.

Instead of cashing out immediately, Yaroch put the stolen funds to work. He deposited them into Suilend, a lending protocol on the Sui blockchain, to earn yield while he figured out his next move — according to reporting, he later told investigators the choice was partly about liking the platform's logo. That detail is almost funny, but it makes a serious point: DeFi protocols don't ask who you are or where your funds came from. There's no compliance officer flagging a government-linked wallet address moving into a lending pool, no KYC form to fill out. The only checkpoint appeared once he tried to convert the crypto back into cash through Kraken, a licensed exchange — and that's also where the paper trail that eventually helped investigators recover most of the funds actually begins.

The theft itself exploited a custody gap. Turning it into usable, growing money exploited a different gap entirely: permissionless finance lets anyone — including someone sitting on stolen government evidence — generate a return with zero friction until they touch a regulated on-ramp or off-ramp.

The uncomfortable answer is that nothing in the public record suggests the FBI's own systems caught this. Yaroch ran the scheme for the better part of a year without internal detection. What actually ended it was that he apparently got cold feet about a plan to flee the country — reportedly using ChatGPT to help think through logistics — and self-reported to colleagues before any internal control flagged the transfers on its own.

That fits a pattern the Justice Department's own inspector general has already documented elsewhere. A prior OIG report on the US Marshals Service found it was tracking seized cryptocurrency using spreadsheets, with no formal, written procedures for how custody actually worked. Separately, the IRS's Criminal Investigation division — which runs what's described as the federal government's most sophisticated crypto-tracing and custody operation — has largely kept its own seized crypto in-house rather than routing it through the Marshals Service since around 2020-21. The federal government's total digital-asset stockpile has grown to an estimated $22 billion or more. This case adds a fresh data point to that same complaint, and a more troubling one: the vulnerability isn't confined to assets that have cleared forfeiture and landed in formal custody. It reaches back into the investigative stage, a stage the existing reform proposals aimed at the Marshals Service may not even cover.

Don't expect a market reaction to this one — there's no single tradable asset or price level at stake, and this is a governance story rather than a trading one. What's more likely is that the Justice Department leans on the roughly 93% recovery rate as proof the system ultimately works, while oversight advocates use the same case to push harder for the fixes the inspector general has already recommended elsewhere: multisig custody, hardware-backed key storage, and documented chain-of-custody rules across all of DOJ's crypto holdings, not just the portion the Marshals Service formally controls. Watch for the ongoing forfeiture proceedings over the recovered funds, and likely follow-up questions from Congress or the inspector general citing this case alongside the earlier Marshals Service findings.

None of that resolves the deeper question the case raises. If a memorized passphrase was enough to move seized crypto undetected for the better part of a year, the real unknown isn't how much the government recovered this time — it's how much of its growing digital-asset stockpile depends on exactly the same kind of trust.