Patrick Steven Yaroch: FBI roles and timeline
Patrick Steven Yaroch, 37, worked on a national security investigative squad at the FBI Boston Division from 2017 until 2025, then served as a supervisory special agent in the FBI Headquarters Counterintelligence and Espionage Division between February 2025 and July 2026. According to court filings and Department of Justice statements, Yaroch was placed on administrative leave on July 29, 2026, after he self-reported the theft to Department of Justice National Security Division and FBI Headquarters employees. He was arrested at his residence on July 31, 2026, and the FBI fired him that same day.
How he used FBI passphrases to move victims' and suspects' crypto
Prosecutors say Yaroch admitted to using passphrases obtained from the FBI's case management systems and from another platform the bureau uses to share investigative data. With those credentials, he transferred cryptocurrency from the wallets of fraud victims and from wallets tied to suspects or nation-state actors under FBI investigation into wallets he controlled.
After making transfers, the filings say, Yaroch attempted to obscure the origin of the funds by exchanging the stolen cryptocurrency for other cryptocurrencies — a basic money-laundering technique in the crypto space that he used repeatedly as part of what prosecutors describe as a wire fraud and money laundering scheme.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadScope: roughly 100 transfers across 35 investigations and $2,474,380.66 taken
The Justice Department's statement quantifies the operation: about 100 fraudulent transfers, linked to 35 separate FBI investigations, that yielded approximately $2,474,380.66 in illicit proceeds. Court documents add granular detail about one short window of activity: between Nov. 25, 2025, and Jan. 13, 2026, Yaroch transferred roughly $93,082 into one of his accounts, then moved those funds among his other accounts and used them to make payments covering credit cards, car payments, and other loans.
Operational consequences for FBI investigations, sources, and intelligence collection
Prosecutors told the court that Yaroch's conduct compromised multiple FBI investigations involving both nation-state adversaries and criminal groups. The Justice Department says the theft undermined FBI sources and methods used in both criminal investigations and foreign intelligence collection — a direct operational impact described in the filings as a consequence of Yaroch's access to and misuse of case-management credentials.
Legal posture, sentencing, and a planned move to Portugal
Yaroch pleaded guilty on Thursday to wire fraud and money laundering charges. He is scheduled to be sentenced on March 4, and faces a statutory maximum of up to 20 years in prison for the wire fraud count and another maximum of up to 20 years for the money laundering count.
Court filings and related evidence in the case also describe steps Yaroch took that prosecutors say reflected an intent to leave the United States. Flight tickets to Lisbon, power-of-attorney documents naming two Portuguese lawyers to obtain a tax identification number, and other materials indicate he was planning to move to Portugal with his family in early September. Prosecutors highlighted a chat Yaroch had with ChatGPT in which he asked, "If you had a bucket ofmoney (around $1 million) and you wanted to leave the USA and become a resident or citizen ofan EU country, what would you do?": ChatGPT's reply mentioned "At 37, with a young family, a goal of potentially retiring around 40, and a clear interest in eventually building a slower-living vineyard/agricultural lifestyle in places like Cilento or Portugal's Dão region…"
What this means for technologists, policymakers, and FBI investigators
- Technologists and security teams: The case underscores the need to protect privileged access within investigative case management systems and data sharing platforms. Prosecutors say defendants' passphrases came directly from those systems, and the theft involved repeated internal credential misuse.
- Policymakers and regulators: The Justice Department's account frames the misuse as not only financial theft but also an operational compromise of investigations and intelligence collection — a point that will likely shape internal reviews and any regulatory or oversight scrutiny of access controls in sensitive systems.
- FBI investigators and affected investigations: Prosecutors explicitly state that multiple investigations, sources, and methods were compromised. Teams tied to the 35 investigations named in filings will need to account for exposed information and any consequent operational risk.
The public record in the filings is straightforward about the mechanics and the damage: an agent with access to investigative credentials used them to divert crypto, moved the funds through other tokens, and appears to have been preparing to relocate overseas. Yaroch's guilty plea resolves the immediate criminal case, but the Justice Department's allegations make clear the incident's operational reverberations within ongoing national security and criminal probes.
