An FBI counterintelligence agent is accused of taking $1m in crypto from the wallets he was watching
Prosecutors say a supervisory special agent used bureau intelligence to obtain passphrases for foreign adversaries' wallets. He has been charged, not convicted, and the case rests on an affidavit.

A supervisory special agent in the FBI's counterintelligence and espionage division has been charged with moving roughly a million dollars in cryptocurrency out of wallets belonging to foreign adversaries and into accounts of his own.
The accused is Patrick Yaroch. According to the arrest affidavit, filed on 1 August, he used intelligence he could reach through bureau systems to obtain the passphrases that controlled those wallets, then made about a dozen transfers beginning in late 2024 or early 2025. The FBI dismissed him on 31 July.
Every one of those specifics comes from a charging document. An affidavit is a prosecutor's account of what they believe they can prove; it is not a finding, and Yaroch has not been convicted of anything. That distinction is the whole story at this stage, and it is the first thing that tends to disappear when a case like this is summarised.
The alleged motive, as described in the affidavit, is not simple enrichment. Investigators say Yaroch had grown frustrated that the bureau was either unwilling or unable to disrupt the cryptocurrency holdings of an unnamed adversarial state. That framing — an agent who concluded the institution would not act and decided to act himself — is what separates this from an ordinary embezzlement case, if it holds up.
The scheme is said to have come apart through a confession rather than through detection. Reporting indicates he told a Justice Department colleague in late July, describing it as something he needed to get off his chest. Investigators searched his residence and recovered a sum reported at $925,426.07 from wallets and accounts.
He faces two charges: interstate transportation of stolen goods, securities and money, and receipt of stolen goods, securities and money. Notably, neither is an espionage or classified-information offence, which is worth registering given the division he worked in. The charges as filed treat this as theft.
Two things follow that are more consequential than the money. The first is a counterintelligence question the bureau will have to answer internally: if the affidavit is accurate, an agent reached operational intelligence about adversary financial infrastructure and used it privately, over a period of months, without a control catching it. The second is evidentiary. Assets seized from a suspect are not the same as assets returned, and cryptocurrency taken from foreign adversarial wallets does not have an obvious party to return it to.
What is not known at this point is substantial: whether he has entered a plea, who represents him, which district is handling the prosecution, and whether the FBI will say anything about how the access went unnoticed. Open News will update this page as the case moves and as documents beyond the affidavit become available.
Key takeaways
See full context →Prosecutors say a supervisory special agent used bureau intelligence to obtain passphrases for foreign adversaries' wallets. He has been charged, not convicted, and the case rests on an affidavit.
5 facts cross-checked
Compared across 5 primary and independent sources.
We are tracking 4 open questions
We’ll update this page as stronger evidence emerges.
Source map
Explore all sources →✓What we know
- Multiple independent sources support the central development.
- The timeline reflects the latest verified update.
- Confirmed facts are separated from analysis and projections.
?What remains unclear
See full context- 4 material questions still need stronger evidence.
- Forecasts may change as official information is released.
How the story developed
- Initial evidence set assembled
Primary material and independent reporting were grouped for comparison.
- Context and open questions added
The preview was updated to separate supported points from unresolved claims.
Why this framing matters
This page focuses on the evidence shared across sources, identifies where reporting diverges, and avoids treating forecasts as established facts. It is intended to complement—not replace—the original reporting.
5 sources reviewed
Every source used in this summary, grouped by its role in the reporting chain.
- 1The BlockPrimary / official sourcePrimary
- 2CNNIndependent reportingCross-check
- 3Washington ExaminerIndependent reportingCross-check
- 4Denver GazetteIndependent reportingCross-check
- 5Crypto BriefingIndependent reportingCross-check
How we verified this story
Open News compared the claims above across primary documents and independent reporting. Status labels reflect the strength and agreement of the available evidence.
Updates and corrections
Preview page created.
Source context and unresolved questions updated.
Join the discussion
Help build a clearer picture. Add context, challenge a claim or share a source.



The reporting agrees on the direction, but the exact timeline still depends on local infrastructure and permitting.
◎Reuters — Full report↗Important context: the public commitments are not the same as completed capacity. The implementation gap is still material.
Here’s the primary document referenced in the latest update.
▧Official statement — Aug. 2, 2026PDF