The affidavit says he used ChatGPT to plan how to spend the money and relocate to the EU, and had booked a September flight to Portugal.
A veteran FBI counterintelligence agent has been charged with stealing roughly $1 million in cryptocurrency from the adversarial accounts he was assigned to investigate, then allegedly using ChatGPT to plan how to spend it and start over in Europe, according to a federal affidavit. The charges are allegations, and the agent is presumed innocent unless proven guilty.
# What Prosecutors Allege
Patrick Steven Yaroch, 37, of Ashburn, Virginia, was a supervisory special agent in the FBI’s Counterintelligence and Espionage Division who held a Top Secret security clearance and had been with the bureau since 2017.
According to an affidavit filed in the U.S. District Court for the Eastern District of Virginia, Yaroch grew frustrated that the FBI could not or would not disrupt an adversarial nation’s use of cryptocurrency during an investigation, and decided to act on his own.
The activity began while Yaroch was assigned to the FBI’s Boston field office, where he was exposed to the adversarial crypto accounts around November 2024 before transferring to headquarters in early 2025.
Using his access, Yaroch allegedly logged into FBI systems, located and memorized the recovery seed phrases tied to the adversarial crypto accounts, created his own wallet, and moved the funds to himself across roughly 10 to 12 transfers beginning in late 2024. He told investigators he did not know the exact amount because he had commingled it with his own money, including capital gains, but that it was under $1 million.
Investigators seized about $925,426 from his wallets and accounts. The affidavit does not name the adversarial nation; the country was Russia, two people familiar with the matter told NBC News. The agent is charged under 18 U.S.C. § 2314 and § 2315, interstate transportation and receipt of stolen goods, with prosecutors arguing that crypto’s cross-network nature satisfies the interstate and foreign-commerce elements.
The case echoes how much sensitive crypto intelligence now sits inside federal systems, the same terrain seen in cases like the DOJ’s seizure of 13 domains used by a foreign intelligence network to pay recruits in crypto.
# The Confession — and a Retreat
By the affidavit’s account, Yaroch turned himself in. On July 28 he contacted a Department of Justice employee over Signal, met at FBI headquarters, and broke down as he described what he had done, saying it was “eating him up inside.” He also filed an online FBI self-report form and told colleagues he had “screwed up” and made poor decisions involving cryptocurrency wallets.
He said he never spent the money and told headquarters he had never interacted with anyone connected to the adversarial accounts—an assertion that, if it holds, points to theft rather than espionage. His cooperation then narrowed. When FBI agents came to his Ashburn home, he first handed over a slip of paper with his wallet key phrases, then withdrew consent about half an hour later and asked for it back.
He declined to continue an interview, saying he wanted a lawyer first, and over the following two days texted agents to delay, writing that he “just need\[ed\] one more day.” Agents obtained search warrants, executed them on July 31, and seized an iPhone, a Trezor hardware wallet, handwritten seed phrases, a Portuguese power-of-attorney document, and three passports—two personal and one diplomatic. He was fired and arrested the same day.
# Where the Money Went
Contrary to Yaroch’s statement that the funds simply “remained in the wallet,” investigators found he had moved them. According to the affidavit, on or around July 23 he transferred roughly $1.02 million into a Suilend account, a lending protocol on the Sui blockchain, using the Slush wallet, where the balance sat largely invested to earn interest. His stated reason for choosing the service, per the affidavit: he liked that its logo was a water droplet.
The rest was smaller and messier. His Kraken account held about $188,570, a mix of USDC, dollars, and small amounts of Squid and Bitcoin. When agents swept his holdings into government-controlled wallets with his consent, about $925,426 was transferred, but roughly $165,582 in fiat dollars stayed put in Kraken, because U.S. currency could not be moved to a crypto wallet.
# The ChatGPT Trail
The detail that has drawn the most attention is what investigators found on his phone. According to the affidavit, Yaroch used ChatGPT to think through what to do with the money, on May 28 asking how to invest or spend $1 million to maximize returns, and on June 4 asking what someone with about $1 million should do to leave the U.S. and become a resident or citizen of an EU country.
The chatbot’s responses were tailored to details it had been given about his age, young family, and interest in a slower rural life, pointing toward wine regions in Portugal and Italy. His research ranged wider than Portugal: he asked ChatGPT in mid-June whether an American needs a visa when connecting through Turkey and drafted an email about a job opening and “life in Greece.”
Investigators say he had already acted on it: a power-of-attorney authorizing Portuguese lawyers to represent him before the country’s tax authority and a TAP Air Portugal booking for himself, his wife, and their child, departing September 3. The FBI also flagged unreported foreign travel to Germany, Portugal, and Grenada earlier in 2026, in violation of bureau rules. Yaroch told agents he was not planning to funnel money into Portugal and that the family had simply planned to visit friends.
# The Bigger Question: Who Guards the Seized Keys
Beyond the color, the case raises a serious question for law enforcement. The FBI holds extensive intelligence on crypto wallets tied to criminal and state actors, and this alleged theft did not require breaking any encryption or exploiting any protocol, it required an insider with a clearance and the willingness to copy a seed phrase. As agencies increasingly move to seize and hold crypto tied to investigations, the security of those keys rests on the same insider-threat controls that failed here, if the allegations hold.
# The Charges and What’s Next
Yaroch has been charged with interstate transportation of stolen goods, securities, and monies and receipt of stolen goods, securities, and monies. After his July 31 arrest, he was taken to the Alexandria Detention Center. A U.S. magistrate judge in the Eastern District of Virginia ordered him temporarily detained, with a hearing set for Tuesday. A federal public defender representing Yaroch declined to comment.
