Why the FBI Could Only Recover Part of the $1 Million an Agent Allegedly Stole

Patrick Steven Yaroch, a former FBI supervisory special agent in the bureau’s Counterintelligence and Espionage Division, didn’t break into the cryptocurrency accounts he’s accused of draining. According to the sworn affidavit filed in support of his arrest, reviewed directly, he memorized the recovery phrases himself, using access he already had. He didn’t hack anything: he used the FBI access he already had While assigned to the FBI’s Boston field office investigating cryptocurrency activity linked to a foreign entity, Yaroch told investigators he searched FBI holdings for the credentials tied to accounts under investigation, then created a personal wallet and entered those phrases to move funds into it. He carried out the transfers roughly ten to twelve times, starting in late 2024 or early 2025. He told agents he never interacted with anyone tied to the accounts, foreign or otherwise, and, according to the affidavit, never spent or moved the money after taking it. The affidavit also identifies a technical distinction: Yaroch described what he used as a “passphrase,” but the FBI’s own affiant notes that he was referring to a seed phrase, a distinction that matters because it gave him full control of the wallet rather than a secondary access code. What was actually stolen, and what wasn’t That mechanism is why the dollar figure attached to this case doesn’t reduce to a single clean number. When FBI agents searched Yaroch’s Ashburn, Virginia home on July 31, they found his holdings split across two platforms in three different forms, and only part of it was cryptocurrency the government could actually seize as such. His Kraken account, accessed on his phone via Face ID (he told agents he didn’t know a username or password for it), held approximately $188,570.58. Of that, only a small fraction, about $4,998.59 in Squid and $1.67 in Bitcoin, was cryptocurrency in a form investigators could transfer on-chain. The bulk of the balance, $165,582.49, was sitting as plain US dollars, funded through a linked TD Bank account. Separately, funds routed through a wallet app called Slush into Suilend, a lending protocol on the Sui blockchain, totaled $933,756.73. The gap between what’s frozen and what’s returned isn’t unique to this case. Circle recently faced a criminal complaint over stolen USDC it was ordered to recover but hadn’t, a reminder that seizing an asset and making a victim whole are two different steps.