The money was small. The failure was not.
On Thursday, November 5, former FBI supervisory special agent Patrick Steven Yaroch pleaded guilty in federal court in Alexandria, Virginia, to wire fraud and money laundering. He admitted to stealing about $2.47 million in cryptocurrency using wallet credentials the bureau had gathered in its own cases. The charges carry up to 20 years, and sentencing is set for March 4, 2027.
Set against this month's $6.36 billion Binance hack, the amount is a rounding error: the Binance theft was roughly 2,500 times larger. The lesson runs the other way. An outside attacker has to break in. Here, the person was already inside, with legitimate access to the keys.
What the plea establishes
Transfers: roughly 100 fraudulent transfers.
Cases: credentials tied to 35 separate FBI investigations.
Wallets drained: those controlled by investigation subjects, by adversarial nation-state actors, and at least one wallet the FBI created for an operation.
Size range: from 81 cents to more than $580,000 in a single transfer, which points to sweeping rather than selective behavior.
Posting: FBI Boston Division from 2017 to 2025, then the Counterintelligence and Espionage Division from February 2025 until July 31, 2026.
Growth of the case: the plea figure is more than double the roughly $1 million cited when he was first charged in August, when about $925,000 was forfeited to government-controlled wallets.
Prosecutors say he converted the proceeds into other digital assets and moved them through further transactions to hide their origin, and that the conduct compromised FBI sources and methods used in both criminal and foreign intelligence cases. Court filings also say he asked ChatGPT about investing the money and moving to Portugal.
How it came to light
According to the public record, Yaroch told a Justice Department employee on July 29 that he had used FBI systems to find the keys needed to move cryptocurrency into his own accounts. He was arrested two days later. Disclosure came through a confession. Whether any monitoring flagged the transfers beforehand has not been made public.
Reports also differ on whether the assets were formally seized and held in government custody or sat in wallets the FBI could reach through credentials collected during investigations. The distinction matters for accounting. The control failure is identical either way: key material was within one person's reach.
A pattern with a decade of history
2015, Silk Road: DEA agent Carl Force was sentenced to 78 months after admitting extortion, money laundering and obstruction. Secret Service agent Shaun Bridges, on the same Baltimore task force, was sentenced to 71 months for moving about 20,000 bitcoin, then worth roughly $350,000, into a wallet he controlled. He admitted to about $820,000 in total, and a later, separate theft added 24 months to run consecutively.
2024 to 2026, Marshals Service contractor: John Daghita, son of the CEO of Command Services & Support, is accused of taking more than $46 million in seized crypto. His father's firm held a contract of roughly $4 million, awarded in October 2024, to help the U.S. Marshals Service manage and dispose of certain seized assets. He was arrested in March 2026 in Saint Martin in a joint FBI and French operation. These are allegations, and the case is unadjudicated.
2026, FBI: Yaroch, $2.47 million, guilty plea.
Three eras, three agencies, one structure: a trusted person with standing access to keys, no second approver, funds moved to a personal wallet, and discovery after the fact.
The common failure: keys without friction
Public blockchains give investigators perfect visibility and zero reversibility. Every one of these thefts was traceable, and tracing is how recovery efforts worked, including the on-chain work behind the Daghita arrest. But a ledger that records everything cannot undo anything. Controls have to act before the transaction, not after it.
What institutional-grade custody looks like
These are industry practices, not disclosed FBI procedures.
Quorum approval: multisig or multi-party computation so no single person can move funds.
Segregation of duties: people who hold case files should not hold signing authority.
No raw secrets in work systems: sweep recovered funds into controlled custody quickly, and keep seed phrases out of case files.
Outbound-movement alerts: real-time monitoring on every known case wallet, so an unexpected transfer pages a second team within minutes.
Independent reconciliation: periodic counts of holdings against on-chain balances. CoinDesk has reported that the Marshals Service lacked reliable bitcoin inventory controls.
Access logging and review: privileged access to credential repositories reviewed on a schedule.
Why it matters beyond one case
The state is a major holder. Analysts estimate Marshals Service holdings at more than 198,000 BTC, and the Marshals are custodian for the U.S. Bitcoin Reserve. When a government sits among the largest holders, the integrity of its custody becomes a market-structure variable, not a footnote.
The damage is investigative, not financial. Compromised sources and methods cost more than $2.47 million. The same bureau is publicly attributing the Binance theft to North Korea, so its credibility on crypto forensics rests partly on how it protects its own keys.
Exchanges and treasuries should read it as a mirror. The attack surface is the employee with legitimate access, and the defense is process, not trust.
What to watch
March 4, 2027: sentence, forfeiture and restitution, with 71 to 78 months from the Silk Road cases as the historical reference point.
Daghita case: progress toward trial, and whether disclosures explain how the Marshals wallets were accessed.
Oversight: any inspector general or congressional review of seized-asset custody.
Control changes: whether the Justice Department or Marshals publish new custody standards.
Data notes
Yaroch figures come from the U.S. Attorney's Office for the Eastern District of Virginia as reported by Cointelegraph, Bitcoin Magazine, Gizmodo and The Record. Silk Road figures come from Justice Department releases and wire reports. Daghita details come from reporting by Bitcoin Magazine, Fortune and The Register, and from ZachXBT's findings. The Binance figure is TRM Labs' estimate. This is analysis and not financial or legal advice.
#FBI #CryptoTheft #Custody #InsiderRisk #SeizedCrypto #USMarshals #SilkRoad #Bitcoin #Compliance #Security