Why the FBI Could Only Recover Part of the $1 Million an Agent Allegedly Stole

MakeCryippreferred on

Patrick Steven Yaroch, a former FBI supervisory special agent in the bureau’s Counterintelligence and Espionage Division, didn’t break into the cryptocurrency accounts he’s accused of draining. According to the sworn affidavit filed in support of his arrest, reviewed directly, he memorized the recovery phrases himself, using access he already had.

He didn’t hack anything: he used the FBI access he already had

While assigned to the FBI’s Boston field office investigating cryptocurrency activity linked to a foreign entity, Yaroch told investigators he searched FBI holdings for the credentials tied to accounts under investigation, then created a personal wallet and entered those phrases to move funds into it. He carried out the transfers roughly ten to twelve times, starting in late 2024 or early 2025. He told agents he never interacted with anyone tied to the accounts, foreign or otherwise, and, according to the affidavit, never spent or moved the money after taking it.

The affidavit also identifies a technical distinction: Yaroch described what he used as a “passphrase,” but the FBI’s own affiant notes that he was referring to a seed phrase, a distinction that matters because it gave him full control of the wallet rather than a secondary access code.

What was actually stolen, and what wasn’t

That mechanism is why the dollar figure attached to this case doesn’t reduce to a single clean number. When FBI agents searched Yaroch’s Ashburn, Virginia home on July 31, they found his holdings split across two platforms in three different forms, and only part of it was cryptocurrency the government could actually seize as such.

His Kraken account, accessed on his phone via Face ID (he told agents he didn’t know a username or password for it), held approximately $188,570.58. Of that, only a small fraction, about $4,998.59 in Squid and $1.67 in Bitcoin, was cryptocurrency in a form investigators could transfer on-chain. The bulk of the balance, $165,582.49, was sitting as plain US dollars, funded through a linked TD Bank account. Separately, funds routed through a wallet app called Slush into Suilend, a lending protocol on the Sui blockchain, totaled $933,756.73. The gap between what’s frozen and what’s returned isn’t unique to this case. Circle recently faced a criminal complaint over stolen USDC it was ordered to recover but hadn’t, a reminder that seizing an asset and making a victim whole are two different steps.

With Yaroch’s signed consent, the FBI’s cryptocurrency team used seed phrases recovered during the search to transfer the crypto-denominated holdings, from both Kraken and Slush/Suilend, into government-controlled wallets:

• Kraken app (Face ID access) → Kraken cryptocurrency balances (USDC, Squid, BTC)
• Slush wallet app → Suilend lending protocol (accessed via 12-word seed phrase)
• Both → transferred to US government-controlled cryptocurrency wallets: $925,426.07 total
• Kraken USD balance ($165,582.49) → left in place, not transferable as crypto

Yaroch himself never gave investigators a fixed number for what he’d taken. He told one Justice Department contact the total was “under a million dollars”; he told a separate FBI supervisory agent it was “approximately one million dollars.” He attributed the gap to commingling the diverted funds with his own personal capital gains inside the same wallet, saying he’d genuinely lost track of the total.

Why Yaroch said he did it

According to the affidavit, Yaroch described becoming

“frustrated” that the FBI “could not or would not act against adversarial cryptocurrency accounts,”

and said he decided to “take matters into his own hands.” The affidavit attributes that explanation to Yaroch’s own statements during a July 29 meeting. Separately, an FBI spokesperson said the bureau “immediately took action” once it learned of the allegations and “does not tolerate” such conduct.

Yaroch faces two federal charges as the case moves to Alexandria court

Yaroch faces two federal charges, interstate transportation of stolen goods, securities, and monies, and receipt of stolen goods, securities, and monies, under 18 U.S.C. §§ 2314 and 2315, filed via criminal complaint in the Eastern District of Virginia. He was arrested at his residence on July 31, immediately after the crypto transfer to government wallets was completed, and was fired from the FBI the same day. Court records indicate he was ordered held pending further proceedings following his arrest. The $165,582.49 still sitting in his Kraken account, untouched by the current seizure, is the open thread most likely to resurface as the case moves forward.Partial recoveries also have a way of dragging on for years rather than closing cleanly, as seen when 500 BTC was recovered after a decade in one Irish case, out of an original 6,000 stolen.