Ex-FBI Agent Pleads Guilty to $2.47M Crypto Theft: What Finance Teams Should Take From It
A former FBI agent has pleaded guilty to stealing about $2.47 million in crypto from wallets tied to FBI investigations, and the case is a useful stress test for anyone who keeps digital asset records. For finance teams, the lesson is practical: when assets move across chains, swap services and lending platforms in a matter of weeks, only a disciplined, well-evidenced ledger lets you prove what you held, who controlled it and where it went. That is the core job of crypto accounting software, and this case shows why it matters well beyond tax season.
What happened: the plea and the court record
According to the U.S. Attorney's Office for the Eastern District of Virginia, as reported by The Block, former FBI agent Patrick Steven Yaroch, 37, of Ashburn, Virginia, pleaded guilty on Thursday to one count of wire fraud and one count of money laundering. Each count carries up to 20 years in prison. Sentencing is set for March 4, 2027.
The scale and method of the thefts
The court filings describe a scheme that began no later than December 2024. Yaroch searched FBI databases, including a classified one, for crypto credentials. He then used what he found to make about 100 transfers out of at least 79 wallets connected to 35 FBI investigations. Most of those wallets belonged to people under investigation. Some were controlled by two adversarial nation states that the filing does not name. NBC News, citing two sources, reported that the adversarial nation in the original complaint was Russia.
The filing also says he made at least 10 transfers from wallets belonging to crime victims in other FBI cases, and at least one from a wallet the FBI had funded for an operation. It calls him "indiscriminate," with individual thefts ranging from 81 cents to more than $580,000. After each theft, he kept checking FBI systems to see whether anyone had noticed.
His role and the financial pressure
Yaroch joined the FBI's Boston Division in 2017 and worked on a squad focused on one of the two nation states. From February 2025 until July 31, 2026, he was a supervisory special agent in the Counterintelligence and Espionage Division at FBI headquarters. The filing says he had taken out more than $100,000 in loans in 2024 and owed more than $45,000 on credit cards before the scheme began.
How the funds moved: a laundering trail across chains
The filing gives one worked example that reads like a case study in on-chain tracing. On Nov. 6, 2025, Yaroch used credentials from a criminal case file to empty two wallets into his own bitcoin wallet. Over the following weeks, he ran the BTC through a swap service with privacy features, converted some of it to Monero (XMR) and then Solana (SOL), and moved the funds through a Sui wallet to his Kraken account.
From wallet to bank account
Between Nov. 25, 2025, and Jan. 13, 2026, he moved about $93,082 to a TD Bank account and used it to pay down debts, including about $30,176 on credit cards and $20,000 toward a Lexus, per the filing. The table below lays out the stages described in the source.
| Stage | What the filing describes |
|---|---|
| Acquisition | Credentials taken from a criminal case file on Nov. 6, 2025; two wallets emptied into his own BTC wallet |
| Obfuscation | BTC run through a swap service with privacy features, partly converted to XMR, then SOL |
| Consolidation | Funds moved through a Sui wallet to a Kraken account |
| Cash-out | About $93,082 sent to a TD Bank account between Nov. 25, 2025 and Jan. 13, 2026 |
| Use of funds | About $30,176 on credit cards and $20,000 toward a Lexus |
Why this pattern matters to a ledger
Every hop in that chain is a taxable or reportable event in a normal accounting context: a swap, a chain change, a transfer to an exchange, a fiat withdrawal. A finance team that tracks asset movements at transaction level, with wallet addresses, hashes, timestamps and counterparties, can reconstruct a path like this. A team that tracks only period-end balances cannot. The thief's approach relied on speed and fragmentation. Reliable bookkeeping is the counterweight, because it turns fragmented movement back into a single auditable story.
The plea terms: restitution, forfeiture and what it signals
Under the plea agreement, Yaroch must pay at least $2.4 million in restitution and faces a forfeiture judgment of at least $2.4 million. He also agreed to forfeit 17,990.67 USDC and about 1.38 million SUI seized on July 31, worth roughly $1.2 million at the time cited in the source, plus the contents of his TD Bank, Charles Schwab, Kraken and BloFin accounts. He acknowledged that the full proceeds of the scheme "are not available."
Seized assets and the gap to full recovery
That last admission is the accounting-relevant detail. Recovery is partial, because some value moved out of reach before agents could act. The filing says that when agents found the wallet he had pointed them to, $1.02 million had already moved out. He then admitted the funds were on the lending platform Suilend and helped agents reinstall a wallet app he had deleted from his phone. For anyone who holds assets, this shows how quickly value can sit in a lending protocol rather than in a plain wallet, and how that changes what a custodian or investigator needs to look for.
Other conditions in the agreement
Yaroch also agreed to be interviewed by Justice Department and FBI officials about his crimes. Any money he makes from books, films, articles or interviews about his FBI work or his case goes to the U.S. government, and he must submit any such work to the FBI for review before publication.
What this means for accounting firms and CFOs
This is not a typical compliance story, and it does not create a new rule. It is an enforcement outcome. Its value to finance professionals lies in what it exposes about control environments, evidence and traceability. The points below are our analysis of the facts, not statements from the court or the Justice Department.
Custody and key-access controls
The thefts worked because credentials sat in case files that an insider could search. The same structural risk exists in corporate treasuries: seed phrases or API keys stored in shared documents, ticketing systems or internal tools, accessible to anyone with the right role. Auditors testing digital asset controls should ask who can view credentials, whether access is logged, and whether anyone reviews that log. Segregation of duties between those who can initiate transfers and those who reconcile them is as relevant here as in any cash control.
Reconciliation and wallet inventory
In the filing, the thief checked FBI systems after each theft to see whether anyone had noticed. Detection depends on someone noticing that balances changed without an authorised transaction. That requires a complete wallet inventory and frequent reconciliation of on-chain balances to the books. Small, irregular outflows, including ones as low as 81 cents, are easy to miss if you only review large movements. A reconciliation process that flags any unapproved outflow regardless of size is stronger than one with a high materiality threshold for movements.
Loss recognition and recovery accounting
A firm that suffers a theft has to decide how to present the loss, and how to treat any later recovery through restitution or forfeiture. The source does not address accounting treatment, and the right answer depends on the framework and the facts, so teams should take it up with their auditors and advisers. What the case does show is that recoveries can be partial and slow, with a stated restitution floor of $2.4 million against a larger total theft. Records that tie each lost asset to a specific wallet, date and amount make any claim far easier to support.
What this means for individual filers and small holders
Although the primary audience here is professional, firms also advise individuals, and some points carry across. Victims named in the filing include people whose wallets were drained in other FBI cases. A person who loses crypto to theft will need transaction-level records to document the loss for any tax or legal purpose. The source says nothing about tax treatment of theft losses, so we do not offer a view on it, but we would stress the practical point: you can only claim, report or recover what you can prove you held.
Practical next steps for finance teams
None of these steps is mandated by the case. They are sensible tests drawn from the facts above.
A short control checklist
- List every wallet, exchange account and lending position the organisation controls, with the named owner of each.
- Confirm where keys, seed phrases and API credentials are stored, and who can access them.
- Reconcile on-chain balances to the ledger on a fixed schedule, and investigate every unexplained outflow regardless of size.
- Capture transaction hashes, timestamps and counterparties for swaps, chain changes and exchange transfers.
- Record positions held in lending protocols separately from plain wallet balances so they are not overlooked.
- Prepare an evidence pack that you could hand to an investigator or auditor within a day.
Where software fits
Good crypto bookkeeping software helps with the tedious parts: ingesting wallet and exchange data, matching transfers between your own addresses so they are not mistaken for disposals, and keeping a time-stamped trail. Digital asset accounting software is only as good as the inputs, so it does not replace access controls or human review. It does make the reconstruction work in a case like this far less painful, and our earlier pieces on the Bitget hack and suspected DPRK theft past $1B in 2026 and how a $10M exchange freeze affects finance teams look at the same evidence questions from the victim side. For the wider framework, see our guide to crypto compliance reporting.
Related enforcement context
The source places this case alongside another matter involving government-held crypto. Earlier this year, the FBI arrested John Daghita in Saint Martin over the alleged theft of more than $46 million in crypto from the U.S. Marshals Service. Onchain investigator ZachXBT said Daghita is the son of an executive at a firm contracted to help the agency manage seized crypto. A federal grand jury in Alexandria indicted Daghita on 15 counts in March, and a French appeals court in Guadeloupe approved his extradition to the U.S. in May, according to local broadcaster RCI. His arraignment is set for Nov. 12 in Alexandria, per his court docket.
Two cases do not make a trend, and we would not claim one. They do show that insiders and contractors with access to credentials are a recognised risk even inside institutions that specialise in tracing crypto. Any organisation that holds assets on behalf of others, or that relies on third-party custodians, should treat its own access model with the same scepticism.
Questions an auditor may now ask
Expect more pointed enquiries about who holds credentials, how third-party custodians restrict staff access, and whether the client can produce a full movement history for any wallet on request. Clients who can answer quickly will have shorter, cheaper audits. Those who cannot should expect more testing and more follow-up requests.
Frequently asked questions
What did the former FBI agent plead guilty to?
According to the U.S. Attorney's Office for the Eastern District of Virginia, he pleaded guilty to one count of wire fraud and one count of money laundering for stealing about $2.47 million in crypto from wallets tied to FBI investigations. Each count carries up to 20 years, and sentencing is set for March 4, 2027.
How much will be recovered?
The plea agreement sets restitution of at least $2.4 million and a forfeiture judgment of at least $2.4 million. Seized assets include 17,990.67 USDC and about 1.38 million SUI, worth roughly $1.2 million at the time cited, plus several bank and exchange accounts. He acknowledged the full proceeds are not available, so recovery is partial.
Does this case change any accounting or tax rules?
No. It is an enforcement outcome, not new guidance. The source does not discuss accounting standards or tax treatment, so any implications we draw are practical lessons on controls and record-keeping, not changes in the rules.
Why does transaction-level record keeping matter in a case like this?
The funds passed through a privacy-featured swap service, were converted to XMR and SOL, moved via a Sui wallet to Kraken and then reached a bank account. Reconstructing that path requires hashes, timestamps and counterparties for every hop. Period-end balances alone cannot show it.
What should a CFO do first after reading this?
Inventory every wallet, exchange account and lending position, confirm who can access the credentials for each, and test whether your reconciliation would catch a small, unauthorised outflow. Then check that you could produce a complete movement history for any wallet quickly if asked.
Source: The Block