FBI Agent Steals Millions in Cryptocurrency, Gets Busted by His Own ChatGPT

Original Title: "The Absurd Theft Scheme of an FBI Agent: Memorized Seed Phrase Used to Steal Millions in Cryptocurrency, Defeated by ChatGPT and Conscience"
Source: angelilu, Foresight News

A former 41-year-old FBI counterintelligence agent has been charged with stealing nearly $1 million in cryptocurrency from an adversary's wallet involved in his own spy case. His method involved memorizing the wallet's seed phrase in his mind, leaving no paper trail, and conducting approximately 10 to 12 transactions to his own account over a year without being detected. On July 31, he was arrested at his home in Ashburn, Virginia, facing federal charges of "interstate transport of stolen property" and "receipt of stolen property," with the FBI having recovered approximately $925,000.

Perhaps the most intriguing aspect of this case is how, as a former agent, he was exposed, marking the most ironic turn: he wasn't caught; he turned himself in. Three days earlier, he arranged to meet with Department of Justice personnel via Signal, and as soon as they sat down, he broke down, admitting he had made a "terrible decision in the cryptocurrency wallet matter" that had been "tormenting him." Even more absurdly, authorities found on his phone a getaway plan he had consulted ChatGPT about.

From Spy Catcher to Self-Thief

The defendant is Patrick Steven Yaroch, a 41-year-old FBI Supervisory Special Agent. He spent about eight years conducting national security investigations at the Boston field office before transferring to FBI headquarters in early 2025, joining the Counterintelligence and Espionage Section, where he obtained access to highly restricted intelligence systems.

According to his own admission to investigators, in November 2024, during a counterintelligence operation, he came into contact with an adversary's encrypted account. He didn't stop at just "contact" - he delved into cryptocurrency, created a wallet for himself, and then went back to the FBI's database to retrieve information about the adversary's encrypted account, memorizing the seed phrases one by one.

In his sworn statement, he was even more candid - he "entered the FBI system, found the keys needed for the transfer." Subsequently, he conducted around 10 to 12 transactions from these adversary accounts, transferring the funds to his one wallet, amassing nearly $1 million. He admitted he couldn't be exact about the amount, as it was commingled with his personal investment returns, but it was definitely less than a million.

Two details are worth noting here. First, the affidavit consistently refers to the plural - "adversarial accounts," "retrieved information from the FBI's database about adversarial encrypted accounts." In other words, the FBI's repository contains credentials for more than one target's wallet, and a special agent can directly retrieve and view plaintext seed phrases. Theoretically, he could have walked away with more than just one person's funds. Second, the investigator deliberately added a footnote to correct him: Yaroch referred to the seed phrase as a "passphrase," which was incorrect. This shows that while Yaroch was engaged in counterintelligence, he had only a partial understanding of cryptographic terms.

The investigators also pointed out that this was not some sophisticated hacking technique; there were no vulnerabilities, no attacks. Possessing the mnemonic phrase was equivalent to owning the wallet. Inputting the phrase into any wallet software would appear as a normal transaction on the blockchain, making it impossible for the network to distinguish the true owner from the key holder.

As for how these adversarial mnemonic phrases initially found their way into the FBI's repository and why they were stored in a retrievable and portable form, the affidavit did not provide details. The foreign targets involved and their respective countries were entirely redacted to maintain confidentiality.

Yaroch gave himself the justification that he was frustrated with the government's inaction regarding the encryption activities of this target, so he decided to take matters into his own hands. He also emphasized that he had never contacted anyone associated with these accounts, and the money had been left untouched. However, all of these statements are solely his claims.

Desiring to Retire Before 40 and Grow Grapes in Portugal

Upon receiving the money, he began to plan out the rest of his life. However, this counterintelligence expert detailed his planning process one by one to ChatGPT.

Text messages retrieved from his phone from May and June showed that he had inquired about how to retire before the age of 40 with $1 million and live in Italy or tend a vineyard in Portugal; he also asked about obtaining EU residency and specifically discussed Portugal based on his family situation.

All the corresponding actions lined up: the family flew from Washington to Lisbon on September 3, and return tickets for September 11 were already booked. In mid-June, he prepared a power of attorney to have a Portuguese lawyer handle his tax and registration matters. The investigators also discovered records of his trips to Germany, Portugal, and Grenada this year, all of which should have been reported as per security clearance protocols, but he failed to report any of them. When questioned, he insisted that he had no intention of transferring the money overseas and claimed the trip to Portugal was merely to visit a friend.

Transferring Money to Suilend Because He Liked the Logo

Yaroch's method of transferring the funds was far from discreet. Approximately $188,500 was placed in a Kraken account linked to a TD Bank account, accessed via facial recognition ID on his phone. Another $1.02 million was transferred at the end of July through an app called Slush into Suilend, a decentralized lending protocol on the Sui blockchain.

The reason for choosing Suilend was also quite absurd: as relayed by investigators, he stated that part of the reason was because he liked the water droplet-shaped logo and intended to earn some returns by depositing the money there to let it sit. However, DeFi lending protocols leave permanent on-chain records, meaning once the wallet ownership is traced, it leads straight to the source.

On July 31, with his consent, the FBI transferred a total of approximately $925,000 from Kraken and Suilend into a government-controlled wallet. An additional $165,000 remained in Kraken—this portion had already been converted to USD and could not be recovered using the same cryptocurrency transfer process.

He Didn't Wait for the Investigation to Come to Him, Instead Contacted the Department of Justice

In the afternoon of July 28, Yaroch proactively contacted a former colleague from the Department of Justice's National Security Division via Signal and met at the FBI headquarters the next day at noon. According to a sworn statement, upon meeting, he became emotional, admitted to making a terrible decision regarding a cryptocurrency wallet, expressed how this issue had been tormenting him, and wanted to "get it off his chest"; he was advised to promptly seek legal counsel and surrender himself immediately.

That same afternoon, he voluntarily contacted the FBI headquarters to request a meeting, submitted a self-report to the Department of Justice online, and in person admitted that he had "screwed up." Later that evening, detectives arrived at his Ashburn home, suspended him from duty, and confiscated government property. During this time, he handed over a piece of paper containing the mnemonic phrase, then minutes later retracted the consent and requested it back, only repeating, "I messed up," and later invoked his right to remain silent. On July 31, the FBI officially terminated his employment; on the same day, after he cooperated in returning the funds to the government wallet, detectives arrested him on the spot.

He explained his self-surrender as out of shame and knowing he had done wrong. As for the mix of whether it was out of a guilty conscience or sensing an impending investigation and wanting to confess preemptively, the sworn statement did not draw conclusions and it is not necessary to make judgments on his behalf.

What This Case Reminds Ordinary People

First, chat records can indeed become evidence. Yaroch's conversations with ChatGPT about retirement plans, immigration, and vineyards all ended up in the case file. What you may think of as casual chat inquiries can actually be used against you.

Second, something the industry should ponder more deeply about: within the FBI's database, mnemonic phrases for adversarial wallets are stored in plain text, allowing a special agent to directly retrieve and transfer out nearly a million dollars without triggering any alerts for over a year. Eventually, it was his guilty conscience that led to his confession. While we discuss the security of cryptocurrency assets and worry about exchange platform hacks or cold wallet losses, we rarely consider that even the evidence held by law enforcement can be mishandled to such an extent. How did these mnemonic phrases initially end up in the FBI's repository, and why were they kept in a form that could be memorized and taken away by one individual?

Original Article Link