# Insider Threat: FBI Supervisory Special Agent Pleads Guilty to Stealing $2.4M in Crypto Seized from Nation-State Hackers and Crime Victims

> Patrick Steven Yaroch, an FBI Supervisory Special Agent in the Counterintelligence and Espionage Division, pleaded guilty to wire fraud and money laundering for stealing about $2.4 million in cryptocurrency. He abused his seniority to access FBI systems holding codes and passwords for cryptocurrency wallets tied to investigations.

- **Published:** 2026-11-06T17:17:58Z
- **Last reviewed:** 2026-11-06T17:17:58Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5433
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5433.png
- **ID:** TL-2026-5433
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** RESOLVED
- **Detections:** 9 (1 shown free below) · **IOCs:** 8

## Description

According to The Record (Recorded Future News, 2026-11-06), Patrick Steven Yaroch, 37, an FBI Supervisory Special Agent at FBI Headquarters in the Counterintelligence and Espionage Division, pleaded guilty to wire fraud and money laundering. He used his seniority to access FBI systems that stored codes and passwords for cryptocurrency wallets under investigation, and made 100 transfers from 79 wallets connected to 35 different FBI investigations. Individual transfers ranged from 81 cents to about $580,000, totaling roughly $2.4 million. Victims included at least two adversarial nations and ten crime victims. The activity is reported to have run from December 2024 through July 2026.

Earlier reporting from the August 2026 arrest and criminal complaint described a narrower scope: about $1 million in digital assets taken from wallets linked to a single adversarial country, with 10-12 withdrawals and roughly $925,000 forfeited to government-controlled wallets. In that account, Yaroch used a pass phrase to a suspect's account that the FBI had obtained during its investigation, moved funds to personal wallets (reported to include Suilend and Kraken accounts), and investigators recovered computing devices, seed phrases and a Trezor hardware wallet. The jump from about $1M to $2.4M reflects the broader scope in the plea reporting; the sources do not reconcile the two figures.

The Record reports that Yaroch was motivated by hundreds of thousands of dollars in credit card debt, loans and car payments; ChatGPT conversations showed plans to buy a vineyard in Portugal and retire, and he had arranged travel to Portugal for September 2026. Court affidavit reporting adds that he was frustrated the FBI could not or would not act against adversarial cryptocurrency accounts. He confessed to a DOJ employee in July 2026, saying it was 'eating him up inside'. The FBI fired him. His actions compromised multiple FBI investigations and exposed sources and methods to targeted subjects. Maximum penalty is up to 20 years; sentencing is scheduled for March 2027.

This is an insider-misuse case: no CVE, malware, network indicator or named threat actor is involved. Defensive value lies in custody controls for seized or high-value cryptocurrency credentials: separation of duties, access logging and review of wallet credential repositories, dual control on seized-asset transfers, and on-chain monitoring of seized wallets.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1552 Unsecured Credentials
- T1213 Data from Information Repositories
- T1657 Financial Theft
- T1078 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Bulk Reads of Seized Crypto Wallet Credential Repository (Yaroch Insider Pattern)** (`TL-2026-5433-SPL-001`)

TL-2026-5433: detects one non-service account reading five or more distinct objects in an hour from file shares that hold seized or custodial cryptocurrency wallet credentials, seed phrases or pass phrases (Windows Security 4663). This is the access abuse behind the FBI insider case: wallet codes and passwords for wallets tied to investigations were retrieved from internal systems (T1552, T1213, T1119, T1078).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1078, T1552, T1213, T1119
- **Data sources:** WinEventLog:Security (EventCode 4663 file system auditing), windows_file_server_audit
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4663 earliest=-24h
```TL-2026-5433 Yaroch insider pattern: bulk reads of wallet credential repositories T1552 T1213```
| eval obj=coalesce(Object_Name, ObjectName), acct=coalesce(Account_Name, SubjectUserName)
| where match(obj, "(?i)(seized[_ -]?(assets|crypto)|crypto[_ -]?custody|wallet[_ -]?cred|seed[_ -]?phrase|pass[_ -]?phrase|mnemonic|keystore|wallet[.]dat)")
| where NOT match(acct, "(?i)(^svc[_-]|^backup|[$]$)")
| bin _time span=1h
| stats dc(obj) AS distinct_objects, count AS reads, values(obj) AS sample_objects BY _time, acct, host
| where distinct_objects>=5
| table _time, acct, host, distinct_objects, reads, sample_objects
````

### Microsoft KQL

```kql
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4663
| where ObjectName matches regex @"(?i)(seized[_ -]?(assets|crypto)|crypto[_ -]?custody|wallet[_ -]?cred|seed[_ -]?phrase|pass[_ -]?phrase|mnemonic|keystore|wallet[.]dat)"
| where SubjectUserName !endswith "$" and SubjectUserName !startswith "svc" and SubjectUserName !startswith "backup"
| summarize DistinctObjects=dcount(ObjectName), Reads=count(), SampleObjects=make_set(ObjectName, 10) by SubjectUserName, Computer, bin(TimeGenerated, 1h)
| where DistinctObjects >= 5
| project TimeGenerated, SubjectUserName, Computer, DistinctObjects, Reads, SampleObjects
```

### Sigma

```yaml
title: Bulk Access to Seized Crypto Wallet Credential Repository
id: 5b1f0c2e-7a41-4d8e-9c36-0a1e5d7b2f01
status: experimental
description: Detects file-audit access to paths holding seized or custodial cryptocurrency wallet credentials, seed phrases or pass phrases, the access abuse seen in TL-2026-5433
references:
  - https://therecord.media/fbi-agent-pleads-guilty-to-stealing-from-nation-state-hackers
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.credential-access
  - attack.t1552
  - attack.t1552.001
  - attack.collection
  - attack.t1213
  - attack.t1119
  - attack.initial-access
  - attack.t1078.002
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4663
    ObjectName|contains:
      - 'seized_assets'
      - 'seized assets'
      - 'crypto_custody'
      - 'cryptocustody'
      - 'wallet_cred'
      - 'seed_phrase'
      - 'seedphrase'
      - 'passphrase'
      - 'mnemonic'
      - 'keystore'
      - 'wallet.dat'
  filter_machine:
    SubjectUserName|endswith: '$'
  condition: selection and not filter_machine
falsepositives:
  - Authorized evidence custodians performing approved wallet intake or reconciliation
  - Backup or DLP scanners running under a named user account
level: medium
```

**Known false positives:**

- Authorized evidence custodians performing approved wallet intake or reconciliation
- Backup, e-discovery or DLP scanners running under a named user account

**Tuning notes:** Enable object-access auditing (SACL) on the wallet credential share first. Replace the path keywords with the real repository folder names, raise or lower the distinct-object threshold of 5, and exclude approved custodian accounts via an allowlist lookup.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Bulk Reads of Seized Crypto Wallet Credential Repository (Sentinel SecurityEvent) (locked: unlock with TL Creds)
- Wallet Seed Phrase and Key Material Staged on Endpoint (Defender DeviceFileEvents) (locked: unlock with TL Creds)
- Corporate Egress to Crypto Exchange and DeFi Platforms (Defender DeviceNetworkEvents) (locked: unlock with TL Creds)
- Access to Seized Crypto Wallet Credential Repository (Sigma, Windows Security 4663) (locked: unlock with TL Creds)
- Wallet Seed Phrase or Key Material File Created on Endpoint (Sigma, file_event) (locked: unlock with TL Creds)
- Access to Crypto Exchange and DeFi Platforms (Sigma, proxy) (locked: unlock with TL Creds)
- Wallet Seed Phrase and Key Material Staged on Endpoint (Insider Credential Handling) (locked: unlock with TL Creds)
- Corporate Egress to Crypto Exchange and DeFi Platforms (Kraken, Suilend, Trezor) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [FBI agent pleads guilty to stealing $2.4 million in crypto from nation-state hackers](https://therecord.media/fbi-agent-pleads-guilty-to-stealing-from-nation-state-hackers)
- [FBI agent is accused of stealing cryptocurrency (GV Wire)](https://gvwire.com/2026/08/03/fbi-agent-is-accused-of-stealing-cryptocurrency/)
- [FBI agent accused of leveraging classified intel in $1 million crypto theft (Washington Examiner)](https://www.washingtonexaminer.com/?p=4672945)
- [Former FBI supervisor charged in $1M crypto theft (Cointelegraph)](https://cointelegraph.com/news/former-fbi-supervisor-charged-1m-crypto-theft)
- [FBI agent is accused of stealing cryptocurrency (The Star)](https://www.thestar.com.my/tech/tech-news/2026/08/05/fbi-agent-is-accused-of-stealing-cryptocurrency)
- [Former FBI agent accused of stealing $1M in cryptocurrency (FOX19)](https://www.fox19.com/2026/08/05/former-fbi-agent-accused-stealing-1m-cryptocurrency/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5433