Skip to navigation

Threat reportThreat IntelligenceTL-2026-5433

Insider Threat: FBI Supervisory Special Agent Pleads Guilty to Stealing $2.4M in Crypto Seized from Nation-State Hackers and Crime Victims

mediumRESOLVED

Patrick Steven Yaroch, an FBI Supervisory Special Agent in the Counterintelligence and Espionage Division, pleaded guilty to wire fraud and money laundering for stealing about $2.4 million in cryptocurrency. He abused his seniority to access FBI systems holding codes and passwords for cryptocurrency wallets tied to investigations. First disclosed .

Key facts for Yaroch FBI insider crypto theft

IdentifiersTL-2026-5433
SeverityMEDIUM
First disclosed
Exploitation statusNo known exploitation
Affected productsUS Federal Bureau of Investigation Internal case systems holding cryptocurrency wallet credentials
Weaknesses (CWE)CWE-269, CWE-284
MalwareKraken
ToolsChatGPT, Trezor hardware wallet
MITRE ATT&CK techniquesT1078 Valid Accounts, T1213 Data from Information Repositories, T1552 Unsecured Credentials, T1657 Financial Theft
MotivationFINANCIAL
Target sectorsgovernment administration, police - law enforcement, finance
Target regionsNorth America
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage for Yaroch FBI insider crypto theft

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5433 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Bulk Reads of Seized Crypto Wallet Credential Repository (Yaroch Insider Pattern)

TL-2026-5433: detects one non-service account reading five or more distinct objects in an hour from file shares that hold seized or custodial cryptocurrency wallet credentials, seed phrases or pass phrases (Windows Security 4663). This is the access abuse behind the FBI insider case: wallet codes and passwords for wallets tied to investigations were retrieved from internal systems (T1552, T1213, T1119, T1078).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1078, T1552, T1213, T1119
  • Data sources: WinEventLog:Security (EventCode 4663 file system auditing), windows_file_server_audit
  • Severity: high
  • Confidence: medium

Splunk SPL

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4663 earliest=-24h
```TL-2026-5433 Yaroch insider pattern: bulk reads of wallet credential repositories T1552 T1213```
| eval obj=coalesce(Object_Name, ObjectName), acct=coalesce(Account_Name, SubjectUserName)
| where match(obj, "(?i)(seized[_ -]?(assets|crypto)|crypto[_ -]?custody|wallet[_ -]?cred|seed[_ -]?phrase|pass[_ -]?phrase|mnemonic|keystore|wallet[.]dat)")
| where NOT match(acct, "(?i)(^svc[_-]|^backup|[$]$)")
| bin _time span=1h
| stats dc(obj) AS distinct_objects, count AS reads, values(obj) AS sample_objects BY _time, acct, host
| where distinct_objects>=5
| table _time, acct, host, distinct_objects, reads, sample_objects

Microsoft KQL

SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4663
| where ObjectName matches regex @"(?i)(seized[_ -]?(assets|crypto)|crypto[_ -]?custody|wallet[_ -]?cred|seed[_ -]?phrase|pass[_ -]?phrase|mnemonic|keystore|wallet[.]dat)"
| where SubjectUserName !endswith "$" and SubjectUserName !startswith "svc" and SubjectUserName !startswith "backup"
| summarize DistinctObjects=dcount(ObjectName), Reads=count(), SampleObjects=make_set(ObjectName, 10) by SubjectUserName, Computer, bin(TimeGenerated, 1h)
| where DistinctObjects >= 5
| project TimeGenerated, SubjectUserName, Computer, DistinctObjects, Reads, SampleObjects

Sigma

title: Bulk Access to Seized Crypto Wallet Credential Repository
id: 5b1f0c2e-7a41-4d8e-9c36-0a1e5d7b2f01
status: experimental
description: Detects file-audit access to paths holding seized or custodial cryptocurrency wallet credentials, seed phrases or pass phrases, the access abuse seen in TL-2026-5433
references:
  - https://therecord.media/fbi-agent-pleads-guilty-to-stealing-from-nation-state-hackers
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.credential-access
  - attack.t1552
  - attack.t1552.001
  - attack.collection
  - attack.t1213
  - attack.t1119
  - attack.initial-access
  - attack.t1078.002
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4663
    ObjectName|contains:
      - 'seized_assets'
      - 'seized assets'
      - 'crypto_custody'
      - 'cryptocustody'
      - 'wallet_cred'
      - 'seed_phrase'
      - 'seedphrase'
      - 'passphrase'
      - 'mnemonic'
      - 'keystore'
      - 'wallet.dat'
  filter_machine:
    SubjectUserName|endswith: '$'
  condition: selection and not filter_machine
falsepositives:
  - Authorized evidence custodians performing approved wallet intake or reconciliation
  - Backup or DLP scanners running under a named user account
level: medium

Known false positives:

  • Authorized evidence custodians performing approved wallet intake or reconciliation
  • Backup, e-discovery or DLP scanners running under a named user account

Tuning notes: Enable object-access auditing (SACL) on the wallet credential share first. Replace the path keywords with the real repository folder names, raise or lower the distinct-object threshold of 5, and exclude approved custodian accounts via an allowlist lookup.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Bulk Reads of Seized Crypto Wallet Credential Repository (Sentinel SecurityEvent) · unlock with TL Creds
  • Wallet Seed Phrase and Key Material Staged on Endpoint (Defender DeviceFileEvents) · unlock with TL Creds
  • Corporate Egress to Crypto Exchange and DeFi Platforms (Defender DeviceNetworkEvents) · unlock with TL Creds
  • Access to Seized Crypto Wallet Credential Repository (Sigma, Windows Security 4663) · unlock with TL Creds
  • Wallet Seed Phrase or Key Material File Created on Endpoint (Sigma, file_event) · unlock with TL Creds
  • Access to Crypto Exchange and DeFi Platforms (Sigma, proxy) · unlock with TL Creds
  • Wallet Seed Phrase and Key Material Staged on Endpoint (Insider Credential Handling) · unlock with TL Creds
  • Corporate Egress to Crypto Exchange and DeFi Platforms (Kraken, Suilend, Trezor) · unlock with TL Creds

Indicators of compromise for Yaroch FBI insider crypto theft

As of 2026-11-06, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5433.

8 indicators of compromise · unlock with TL Creds. Compare plans

How Yaroch FBI insider crypto theft works

According to The Record (Recorded Future News, 2026-11-06), Patrick Steven Yaroch, 37, an FBI Supervisory Special Agent at FBI Headquarters in the Counterintelligence and Espionage Division, pleaded guilty to wire fraud and money laundering. He used his seniority to access FBI systems that stored codes and passwords for cryptocurrency wallets under investigation, and made 100 transfers from 79 wallets connected to 35 different FBI investigations. Individual transfers ranged from 81 cents to about $580,000, totaling roughly $2.4 million. Victims included at least two adversarial nations and ten crime victims. The activity is reported to have run from December 2024 through July 2026.

Earlier reporting from the August 2026 arrest and criminal complaint described a narrower scope: about $1 million in digital assets taken from wallets linked to a single adversarial country, with 10-12 withdrawals and roughly $925,000 forfeited to government-controlled wallets. In that account, Yaroch used a pass phrase to a suspect's account that the FBI had obtained during its investigation, moved funds to personal wallets (reported to include Suilend and Kraken accounts), and investigators recovered computing devices, seed phrases and a Trezor hardware wallet. The jump from about $1M to $2.4M reflects the broader scope in the plea reporting; the sources do not reconcile the two figures.

The Record reports that Yaroch was motivated by hundreds of thousands of dollars in credit card debt, loans and car payments; ChatGPT conversations showed plans to buy a vineyard in Portugal and retire, and he had arranged travel to Portugal for September 2026. Court affidavit reporting adds that he was frustrated the FBI could not or would not act against adversarial cryptocurrency accounts. He confessed to a DOJ employee in July 2026, saying it was 'eating him up inside'. The FBI fired him. His actions compromised multiple FBI investigations and exposed sources and methods to targeted subjects. Maximum penalty is up to 20 years; sentencing is scheduled for March 2027.

This is an insider-misuse case: no CVE, malware, network indicator or named threat actor is involved. Defensive value lies in custody controls for seized or high-value cryptocurrency credentials: separation of duties, access logging and review of wallet credential repositories, dual control on seized-asset transfers, and on-chain monitoring of seized wallets.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts

Persistence

T1078 Valid Accounts

Collection

T1213 Data from Information Repositories

Credential Access

T1552 Unsecured Credentials

Impact

T1657 Financial Theft

Remediation for Yaroch FBI insider crypto theft

Immediate actions

  • Audit access logs for systems that store wallet credentials, seed phrases or pass phrases for seized or evidentiary crypto assets
  • Monitor seized and custodial wallets on-chain for outbound transfers not matched to an authorized legal process

Longer-term hardening

  • Require dual control and separation of duties for any movement of seized or high-value cryptocurrency
  • Store wallet credentials in HSM or vault-backed custody with per-access approval and tamper-evident logging
  • Apply insider-risk monitoring to privileged staff, including financial-stress and behavioral indicators under policy and legal review
  • Run periodic reconciliation of seized-asset balances against case records

Affected and fixed versions

  • US Federal Bureau of Investigation — Internal case systems holding cryptocurrency wallet credentials

Timeline of Yaroch FBI insider crypto theft

  • Unauthorized transfers begin (December 2024 per The Record; early affidavit reporting says late 2024 or early 2025); day not stated
  • Yaroch's locked-ioc-7 queries about investing and spending $1 million and retiring to a vineyard in Portugal or Italy, per affidavit reporting (May 2026; day not stated)
  • Yaroch confesses to a DOJ employee, saying it was 'eating him up inside'; reported as late July 2026, day not stated
  • Arrested after being fired by the FBI, per Washington Examiner; criminal complaint and affidavit filed in the Eastern District of Virginia
  • Case first reported publicly: about $1 million in crypto from an adversarial nation's wallets, roughly $925,000 forfeited to government-controlled wallets
  • Planned travel to Portugal (September 2026; day not stated), per The Record; the trip was arranged before the confession
  • The Record reports Yaroch pleaded guilty to wire fraud and money laundering: 100 transfers from 79 wallets tied to 35 FBI investigations, about $2.4M, at least 2 adversarial nations and 10 crime victims
  • Sentencing scheduled for March 2027 (day not stated); maximum penalty up to 20 years

Sources cited for Yaroch FBI insider crypto theft

Previous and next in threat intel

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats