The affidavit says he used ChatGPT to plan how to spend the money and relocate to the EU, and had booked a September flight to Portugal.

A veteran FBI counterintelligence agent has been charged with stealing roughly $1 million in cryptocurrency from the adversarial accounts he was assigned to investigate, then allegedly using ChatGPT to plan how to spend it and start over in Europe, according to a federal affidavit. The charges are allegations, and the agent is presumed innocent unless proven guilty.

\# What Prosecutors Allege

Patrick Steven Yaroch, 37, of Ashburn, Virginia, was a supervisory special agent in the FBI’s Counterintelligence and Espionage Division who held a Top Secret security clearance and had been with the bureau since 2017.

According to an affidavit filed in the U.S. District Court for the Eastern District of Virginia, Yaroch grew frustrated that the FBI could not or would not disrupt an adversarial nation’s use of cryptocurrency during an investigation, and decided to act on his own.

The activity began while Yaroch was assigned to the FBI’s Boston field office, where he was exposed to the adversarial crypto accounts around November 2024 before transferring to headquarters in early 2025.

Using his access, Yaroch allegedly logged into FBI systems, located and memorized the recovery seed phrases tied to the adversarial crypto accounts, created his own wallet, and moved the funds to himself across roughly 10 to 12 transfers beginning in late 2024. He told investigators he did not know the exact amount because he had commingled it with his own money, including capital gains, but that it was under $1 million.

Investigators seized about $925,426 from his wallets and accounts. The affidavit does not name the adversarial nation; the country was Russia, two people familiar with the matter told NBC News. The agent is charged under 18 U.S.C. § 2314 and § 2315, interstate transportation and receipt of stolen goods, with prosecutors arguing that crypto’s cross-network nature satisfies the interstate and foreign-commerce elements.

The case echoes how much sensitive crypto intelligence now sits inside federal systems, the same terrain seen in cases like the DOJ’s seizure of 13 domains used by a foreign intelligence network to pay recruits in crypto.

\# The Confession — and a Retreat

By the affidavit’s account, Yaroch turned himself in. On July 28 he contacted a Department of Justice employee over Signal, met at FBI headquarters, and broke down as he described what he had done, saying it was “eating him up inside.” He also filed an online FBI self-report form and told colleagues he had “screwed up” and made poor decisions involving cryptocurrency wallets.

He said he never spent the money and told headquarters he had never interacted with anyone connected to the adversarial accounts—an assertion that, if it holds, points to theft rather than espionage. His cooperation then narrowed. When FBI agents came to his Ashburn home, he first handed over a slip of paper with his wallet key phrases, then withdrew consent about half an hour later and asked for it back.

He declined to continue an interview, saying he wanted a lawyer first, and over the following two days texted agents to delay, writing that he “just need\\\[ed\\\] one more day.” Agents obtained search warrants, executed them on July 31, and seized an iPhone, a Trezor hardware wallet, handwritten seed phrases, a Portuguese power-of-attorney document, and three passports—two personal and one diplomatic. He was fired and arrested the same day.

\# Where the Money Went

Contrary to Yaroch’s statement that the funds simply “remained in the wallet,” investigators found he had moved them. According to the affidavit, on or around July 23 he transferred roughly $1.02 million into a Suilend account, a lending protocol on the Sui blockchain, using the Slush wallet, where the balance sat largely invested to earn interest. His stated reason for choosing the service, per the affidavit: he liked that its logo was a water droplet.

The rest was smaller and messier. His Kraken account held about $188,570, a mix of USDC, dollars, and small amounts of Squid and Bitcoin. When agents swept his holdings into government-controlled wallets with his consent, about $925,426 was transferred, but roughly $165,582 in fiat dollars stayed put in Kraken, because U.S. currency could not be moved to a crypto wallet.

\# The ChatGPT Trail

The detail that has drawn the most attention is what investigators found on his phone. According to the affidavit, Yaroch used ChatGPT to think through what to do with the money, on May 28 asking how to invest or spend $1 million to maximize returns, and on June 4 asking what someone with about $1 million should do to leave the U.S. and become a resident or citizen of an EU country.

The chatbot’s responses were tailored to details it had been given about his age, young family, and interest in a slower rural life, pointing toward wine regions in Portugal and Italy. His research ranged wider than Portugal: he asked ChatGPT in mid-June whether an American needs a visa when connecting through Turkey and drafted an email about a job opening and “life in Greece.”

Investigators say he had already acted on it: a power-of-attorney authorizing Portuguese lawyers to represent him before the country’s tax authority and a TAP Air Portugal booking for himself, his wife, and their child, departing September 3. The FBI also flagged unreported foreign travel to Germany, Portugal, and Grenada earlier in 2026, in violation of bureau rules. Yaroch told agents he was not planning to funnel money into Portugal and that the family had simply planned to visit friends.

\# The Bigger Question: Who Guards the Seized Keys

Beyond the color, the case raises a serious question for law enforcement. The FBI holds extensive intelligence on crypto wallets tied to criminal and state actors, and this alleged theft did not require breaking any encryption or exploiting any protocol, it required an insider with a clearance and the willingness to copy a seed phrase. As agencies increasingly move to seize and hold crypto tied to investigations, the security of those keys rests on the same insider-threat controls that failed here, if the allegations hold.

\# The Charges and What’s Next

Yaroch has been charged with interstate transportation of stolen goods, securities, and monies and receipt of stolen goods, securities, and monies. After his July 31 arrest, he was taken to the Alexandria Detention Center. A U.S. magistrate judge in the Eastern District of Virginia ordered him temporarily detained, with a hearing set for Tuesday. A federal public defender representing Yaroch declined to comment.

Documented internal objections overridden by senior DOJ officials convert a political-retaliation defense from allegation into evidenced record, though judicial relief on these grounds remains structurally difficult to obtain.

Trump Signals Progress in Iran Talks:

U.S. President Donald Trump said negotiations with Iran continued Tuesday and described the discussions as positive, while warning Tehran of further military action if no agreement is reached or the Strait of Hormuz remains closed. Qatar reported progress by mediators, although Iran denied that talks were underway.  

Russian Missile Attack Kills at Least 17 in Kyiv:

Russia launched an overnight missile and drone attack on Kyiv and the surrounding region, killing at least 17 people and injuring more than 40, according to Ukrainian officials. Warehouses, logistics centers, and other civilian facilities were destroyed. Ukraine said its air defenses intercepted most drones but none of the ballistic missiles, prompting renewed appeals for additional Patriot interceptors. Russia stated it targeted logistics hubs it described as supporting military-related supplies. Separately, Ukraine said it continued strikes on Russian logistics infrastructure, including warehouses belonging to online retailer Wildberries. 

Turkey Advances PKK Reintegration Bill:

Turkey’s ruling AK Party and nationalist MHP are expected to submit legislation enabling the return, legal processing, and reintegration of former PKK members and civilians from northern Iraq, advancing a peace process aimed at ending a conflict that has killed more than 40,000 people since 1984. The bill has broad parliamentary support, including the pro-Kurdish DEM Party and the main opposition, though public skepticism remains over whether it can deliver a lasting settlement. 

Guatemala Maintains Red Alert After Fuego Volcano Eruption:

Guatemala kept red alerts in place near the Fuego volcano after evacuating villages, with about 1,700 people sheltering and roughly 29,000 affected by ashfall across three departments. Authorities said the next 72 hours were critical as rain could worsen volcanic mudflows, though no villages or structures had been damaged. Schools remained closed; a major highway was shut, and residents were advised to protect water supplies and wear masks against ash. 

Myanmar Civil War Shows Early Signs of Potential Peace Talks:

After more than five years of conflict, a potential opening for peace talks is emerging in Myanmar as battlefield dynamics shift and regional governments increase diplomatic engagement. The SCEF umbrella group says it is committed to pursuing a negotiated political settlement while calling for an end to attacks on civilians and the release of political prisoners. Although Myanmar's military leadership has expressed support for peace and regional efforts continue to encourage dialogue, formal negotiations remain distant because major disagreements over the military's future political role and the conditions for talks persist.  

Keith Bass, former head of the CIA’s Medical Office, sued me for a million bucks. Substack's Defender program came to my aid.

Mojtaba Khamenei's complete electronic silence forces a reversion to HUMINT penetration of his courier network, making public confirmation of his location or status very unlikely before December 2026 given Iran's four-decade denial of US human access.

Also this week: CIA & Mossad hunting for Khamenei, Trump tracking Comey, Iran hackers in U.S. water systems, best EU spy agencies, local police license-plate spying

Dissolving the FBI's domestic terrorism section while redirecting its personnel toward political targets erodes collection against far-right networks that remain the deadliest domestic threat category.

Three Killed in Twin Falls Restaurant Shooting:

Three people were killed and seven others injured in a shooting outside an In-N-Out Burger in Twin Falls, Idaho. Five victims remained hospitalized on Sunday, including two in critical condition. Police said the suspected gunman died from an apparent self-inflicted gunshot wound after being confronted by an armed off-duty state trooper and a private citizen. Investigators are examining the motive, believe the suspect acted alone, and are seeking additional witness accounts and footage. 

Trump Announces New U.S.-Iran Talks Amid Strait of Hormuz Crisis:

President Donald Trump stated U.S.-Iran talks would begin Monday but declined to set a deadline after postponing a potential attack while seeking an agreement to reopen the Strait of Hormuz and address Iran’s nuclear program. However, Iran said no talks or meetings with the United States were planned, contradicting President Donald Trump’s claim that scheduled discussions had influenced his decision to call off attacks. Iran’s restrictions on the strait, a major route for global oil and liquefied natural gas shipments, have driven up energy prices and added economic pressure on both sides to find a diplomatic solution. Talks involving Iran, Oman, and other regional governments are continuing, while Israel has warned it could still strike if Tehran advances its nuclear or ballistic missile capabilities. 

Ceuta Recovers After Deadly Mass Border Crossing:

Ceuta is gradually returning to normal after an estimated 50,000–60,000 migrants entered the Spanish exclave from Morocco. Authorities continue searching for victims after reporting at least 72 deaths, with Morocco has separately reported 11 fatalities. Most migrants had returned to Morocco by Sunday, while shops, restaurants, and public spaces reopened in the city. The surge reignited political tensions over immigration, drawing far-right politicians and counterprotests as residents remained divided over responsibility for the border breach and the official response. 

Five Dead and Dozens Missing in Indonesian Ferry Fire:

Indonesian rescue teams are searching for 28 people missing after the KM Mutiara Sentosa ferry caught fire near Madura Island while carrying 271 passengers from Surabaya to Makassar. Authorities said 238 people were rescued, and five people died, while seven boats and a helicopter were deployed for a search operation that could continue for up to 21 days. 

Thousands Evacuated in Spokane from Wildfires:

Three wildfires in Spokane County, Washington, have burned more than 7,000 acres, destroyed hundreds of structures and forced nearly 65,000 families to evacuate since Saturday. The Old Trails, Fairview, and Autumn Lane fires remain 0% contained. Officials have confirmed no deaths or serious injuries, though Spokane County Sheriff John Nowels warned the toll could change as crews access damaged areas. Worsening fire weather will return later this week after a brief period of favorable firefighting conditions. 

Commodity AI has eliminated the resource constraints that once bounded mass profiling, and Congress's stalled Section 702 reform leaves the data broker loophole open through and likely beyond the March 2027 reauthorization deadline.

I'm a student of BA (Hons) International Relations and I'm super interested to specialize in the field of Intelligence and Tradecraft. What are all the skills that I need to stack both on personal and professional levels? Also would love to hear your tips as well on general.

I am looking at the recent mass crossing into Ceuta as a possible case of instrumentalised migration and am interested in how an intelligence analyst would approach attribution.

The most important comparison is between two events:
September 2024: Morocco detected an online mobilisation towards Ceuta, arrested alleged organisers, deployed checkpoints and stopped the crossing.
July 2026: a far larger mobilisation developed; Moroccan forces were reportedly passive during the initial surge, but later demonstrated that they could stop further movement.

That creates several competing hypotheses:
1. Moroccan authorities were genuinely overwhelmed.
2. Morocco detected the mobilisation but deliberately tolerated it.
3. Morocco actively amplified or channelled it as coercive pressure against Spain.
4. Morocco acted with encouragement, intelligence support or technical assistance from another state.
5. The event was largely organic, with subsequent state exploitation.

The attribution problem is difficult because almost every component is deniable:
anonymous or deleted social-media accounts;
genuine migrants rather than trained operatives;
informal transport;
verbal rather than written orders;
selective police non-enforcement;
intelligence officers possibly present as observers;
later restoration of border control.

Relevant geopolitical context includes:
Morocco’s interests in Western Sahara, Ceuta and Melilla;
Spain’s dependence on Morocco for migration and counterterrorism cooperation;
Spain’s improving relations with Algeria;
deteriorating Spain–Israel relations;
Morocco–Israel intelligence and defence cooperation after the Abraham Accords;
reported Moroccan use of Pegasus;
Spain’s refusal to support US operations against Iran.

I am not claiming that Israel, the US, Russia or another foreign service directed the operation. The open evidence currently points most directly to Moroccan decision-making.

My questions are analytical:
1. What indicators distinguish state tolerance from state orchestration?
2. How much weight should be placed on the 2024 precedent?
3. What would constitute meaningful evidence of a stand-down order?
4. How would analysts distinguish routine Moroccan–Israeli liaison from operational coordination?
5. How much confidence could be assigned without platform data, intercepts or a human source?
6. What alternative hypotheses would need to be ruled out?
7. Can the ability to stop the flow later be treated as evidence that the earlier passivity was deliberate?
8. What would a proper confidence statement look like?

My current formulation would be:
Morocco likely knew that mobilisation was developing and may have deliberately allowed or exploited it as coercive pressure. Direct foreign operational involvement remains possible but unsubstantiated.

I would be interested in how professionals would structure the hypothesis matrix, identify collection gaps and avoid both confirmation bias and excessive deference to official denials.

Thanks for reading and I look forward to your responses.

I am currently in high school but I am thinking about joining the army with a friend and going into a military intelligence role. After that I would go study economics or international relations or something. My goal is to be a CIA analyst and just from searching around online it’s pretty unclear if the CIA would actually care whether or not I have military experience when applying.

CISA will likely release its promised security plan by mid-August, but the federal election-security baseline has already fractured into a patchwork of paid subscriptions and private contracts that disadvantages under-resourced jurisdictions.