FBI Supervisory Agent Guilty of Stealing $2.4 M in Crypto Using Privileged Access to Nation‑State Wallets
What Happened — A senior FBI Supervisory Special Agent, Patrick Steven Yaroch, pleaded guilty to wire fraud and money‑laundering charges after admitting he used his privileged access to FBI systems to transfer more than $2.4 million in cryptocurrency from wallets tied to nation‑state hackers and ten crime‑victim accounts. Between December 2024 and July 2025 he executed roughly 100 transfers from 79 wallets that were part of 35 separate FBI investigations. The theft was motivated by personal debt and a desire to fund a planned move to Portugal. Prosecutors said his actions compromised multiple investigations, exposing sources, methods, and the integrity of ongoing counter‑intelligence work. He is scheduled for sentencing in March 2026. Source: The Record
Why It Matters for Trust & Control Assurance — The case highlights the critical need for robust privileged‑access controls, segregation of duties, and immutable audit logs to satisfy control‑objective requirements across frameworks.
Who Is Affected — Federal law‑enforcement agencies, intelligence units, and any organization that grants privileged cryptocurrency or cryptographic key access to personnel.
Recommended Actions
- Enforce least‑privilege principles for all privileged accounts and require multi‑factor authentication.
- Deploy continuous monitoring and immutable logging of privileged actions, and regularly review access entitlements against job responsibilities.
Technical Notes
- Attack vector: Abuse of stolen privileged credentials (crypto wallet keys) within FBI internal systems.
- No public‑facing software vulnerability was exploited; the breach stemmed from insider misuse of authorized access. Source: [The Record]