FBI Agent Crypto Theft Case: What the $2.47 Million Loss Teaches Holders

A wallet can still show your old transactions even after the money is gone. That makes it hard to tell where to begin.

A federal case puts one question in plain view: who can actually authorize a transfer? The answer matters when you’re trying to protect what’s left.

Overview

What the Justice Department says happened

Former FBI agent Patrick Steven Yaroch pleaded guilty on November 5, 2026, to wire fraud and money laundering related to stealing cryptocurrency.

According to the Justice Department’s account, he used access to credentials tied to 35 investigations and obtained about $2.47 million through approximately 100 unauthorized transfers.

The DOJ describes wallets controlled by subjects of investigations or nation-state actors and at least one wallet the FBI created for an operation.

That doesn’t mean all the money was in government custody, or that there is a new program to reimburse people who lost crypto elsewhere.

Why the credentials mattered more than the device

Some wallets use a recovery phrase that can restore access if a phone breaks or a hardware wallet is lost. It’s meant to be a backup.

That same property makes the phrase sensitive. Someone with sufficient recovery information may gain control without possessing your phone or guessing its screen lock.

Different wallets use different safeguards. An exchange account and a self-custody wallet do not have the same recovery process, even if their balances look similar.

If you can still unlock an app, don’t take that as evidence that only you control its assets. Two people can have access to the same wallet.

What you can do without trusting a stranger

• Protect what’s left: Identify whether you use a hosted exchange account, a self-custody wallet, or both before choosing a response.
• Preserve useful evidence: Save transaction identifiers, dates, amounts, account notifications, and any relevant communications without including wallet secrets.
• Verify official contact: Find the agency or exchange independently rather than replying to someone who offers to unlock, validate, or return funds.
• Refuse recovery fees: An unsolicited payment demand is not a step in an official criminal investigation or a DOJ remission petition.

This was an insider theft case. It isn’t evidence that the FBI sent a scam notice to the public or that your exchange has been breached.

The case does illustrate why account protection and wallet protection need to be handled differently. Start by working out which kind of access you may have lost.

What the Case Tells You About Wallet Access

A backup can be more powerful than a password

A password or PIN may protect access to an app or piece of hardware. Recovery information can serve a different purpose: restoring the keys the wallet uses.

Changing a local password doesn’t change a recovery phrase someone already copied. That is why a familiar app screen can give the wrong kind of reassurance.

Think about which secret controls the asset, not just which secret opens the screen. If you aren’t sure, check the wallet maker’s official support material.

Do not type your phrase into a webpage that promises to check whether it has been leaked. That gives the page the very information you’re trying to protect.

A public transaction doesn’t disclose the recovery phrase

On many blockchains, people can look up transaction details without knowing anything about the person controlling the wallet. Seeing a transfer isn’t evidence of privileged access.

A transaction identifier can be useful for a report. Someone who repeats it to you hasn’t proved they work for an exchange or are authorized to move funds.

A screenshot of a balance is even less useful. It doesn’t tell you who controls the account or whether the amount is available to send.

Compare a claim against your own records. An investigator needs the details of what happened, not your private keys or a test payment from you.

Moving money and getting money back are separate problems

The DOJ says Yaroch moved stolen assets and laundered proceeds. The guilty plea doesn’t turn that money into a balance any reader can claim.

Don’t assume that a transfer you can trace is a transfer an exchange can reverse. You can report it, but the available options depend on the facts.

The FBI’s recovery-fraud advisory says private recovery firms can’t issue seizure orders. Exchanges act under their own processes or in response to legal process.

Keep evidence and contact official channels quickly. A stranger who guarantees a refund before asking what actually happened isn’t giving you a reliable assessment.

What to Do if You Find a Transfer You Didn’t Make

1. Stop using the contact who alerted you. Open the wallet or exchange independently and compare the transaction with your own history before clicking anything.
2. Protect your exchange account if one is involved. Use the exchange’s genuine security and support channels to restrict access and report any unauthorized withdrawal.
3. Treat a copied recovery phrase as compromised. Use a trusted device and official wallet guidance to plan how to protect remaining assets with fresh credentials.
4. Save transaction evidence. Record the network, transaction identifier, sending and receiving addresses, amount, and date. Keep any related support ticket or messages.
5. Report the theft through official channels. In the U.S., use the FBI’s Internet Crime Complaint Center and follow relevant law-enforcement or exchange instructions.
6. Don’t pay someone who promises a reversal. Verify any claim of recovered funds through the official case contact before handing over information.
7. Check related access. Review other wallets or accounts that may use the same recovery material, login credentials, device, or recovery email.

If you use an exchange account

An exchange may be able to review sign-ins and withdrawal activity. It may also have tools for reporting a compromise or temporarily locking the account.

Use those tools through the website or app you already know. Don’t take instructions from a support account that contacted you first in a comment thread.

Check whether anyone changed the recovery email, added a device, or altered withdrawal settings. Tell support which changes you recognize and which you don’t.

If your email account was also exposed, secure it from a trusted device. Otherwise, somebody may still be able to intercept reset messages.

Ask for the exchange’s case reference. It lets you attach further evidence without starting again each time another member of the support team replies.

If you control the wallet keys yourself

First establish whether your recovery information may have been copied. An unfamiliar transaction alone doesn’t establish how the loss happened.

If a phrase may be compromised, a new password on the same wallet is not enough. Use genuine wallet guidance for moving any remaining assets securely.

Don’t create a replacement wallet on a device you think someone controls. If necessary, get reputable help, but keep the secret information in your own hands.

Also consider whether other accounts were created from the same recovery information. A separate label in the app doesn’t always mean a separate set of keys.

If you never shared the phrase but approved an unfamiliar transaction, tell support exactly what you authorized. The response to a suspicious approval may be different.

How to Verify a Claim That Your Crypto Was Recovered

A genuine case number does not authenticate the sender

Press releases and some court information are public. Someone can mention a genuine prosecution in a message without having any role in it.

If the message says that a real investigation found your funds, find the relevant office through its official site and ask about the claim yourself.

Provide only what it needs to identify the case. A stranger’s deadline is not a reason to send an identity document to an address they supplied.

Ask whether the office has a public notice for the case or can direct you to a verified contact. Don’t use a QR code from the message.

Real restitution and remission have specific rules

The DOJ’s victim compensation page describes official processes for returning certain forfeited assets. It warns that paying a fee isn’t required for remission.

Restitution and remission are not interchangeable. Eligibility and the amount available depend on the case. An announcement of a plea is not an entitlement letter.

If someone offers a guaranteed amount before your connection to a case is verified, don’t pay. Neither a deposit nor a wallet sign-in proves eligibility.

A separate private legal service can charge for its own work, but that isn’t a government release fee. Don’t confuse the two when checking an invoice.

Save messages even if you refused to pay

Recovery fraud can be worth reporting even when you spotted it early. Save the claimed agency, contact details, and what they asked you to authorize.

If the offer arrived after you reported a theft, check your existing case independently. The timing alone doesn’t prove the person can see your report.

Use the FBI’s guidance for cryptocurrency scam victims to organize your report. Keep identifiers and dates separate from secret recovery material.

Don’t try to draw the caller out. Your priority is securing what remains and giving a verified investigator the information they can actually use.

What to Put in a Short Incident Timeline

Start with the last transaction you know you made. Note when you noticed the unfamiliar one and whether any password or device alerts arrived around then.

Write down whether you used an exchange or wallet directly, and whether you received a call, clicked a link, or approved anything unusual.

For each transfer, record the displayed amount and asset name as well as the network. Two similarly named assets or networks can confuse a report.

If you contacted support, write down the official channel you used and the ticket number. Keep new messages separate until you can verify that they belong.

Save the timeline somewhere private. People helping you file a report don’t need a photo of the recovery phrase, the original backup, or your app PIN.

If new transfers appear, update the timeline rather than deleting the original evidence. Your first report can remain useful even if more information becomes available.

Reduce the Number of Places That Hold Your Recovery Information

Inventory where the recovery information lives without making fresh copies. Think about how you originally stored it, who could reach it, and whether you changed phones.

If you find it in an old photograph, remember that a photo can be synchronized beyond the original device. Deleting one copy doesn’t settle who saw it.

Don’t move it to another cloud account just to get it out of the first one. Use the storage approach recommended by the wallet provider you trust.

Keep public transaction records separate from secret recovery information. You can share a specific transaction reference for a report without sending an entire backup.

For a wallet you share with a business partner, document who can authorize transfers and who handles a suspected incident. Agree how you will verify unusual instructions.

If your setup requires more than one approval, make sure everyone involved understands the recovery plan before something goes wrong. A second approval isn’t useful if nobody can reach it.

Don’t let an online recovery service take over the entire job. Giving one unknown person control of your computer and wallet removes the checks you already had.

Ask a verified support team what can be checked without disclosing secrets. If a stranger insists the phrase is needed for a diagnosis, end the conversation.

Use a safe place for the information you’ll need if a device is lost. The goal is to protect the backup, not to leave yourself without one.

When you no longer use a wallet, record that decision in your own inventory. It helps distinguish old addresses from ones you still need to protect.

Frequently Asked Questions

Was the Yaroch guilty plea a cryptocurrency recovery program?

No. The DOJ announced a guilty plea related to cryptocurrency theft. The announcement doesn’t offer a public refund or invite unrelated victims to pay a fee.

Can someone use my wallet without stealing my hardware device?

Potentially. Recovery information may let them restore wallet access without the original device. The exact risk depends on how your wallet protects its keys.

Will changing my exchange password protect a self-custody wallet?

No. An exchange account password and a self-custody wallet’s recovery information protect different things. Find out which was exposed before deciding what to change.

Can someone reverse a confirmed blockchain transfer for me?

Don’t trust a guarantee. An exchange or investigator may have options in specific circumstances, but a third party cannot promise recovery just from a transaction identifier.

Should I give an investigator my recovery phrase?

Do not share it with an unsolicited contact. Start with transaction details and verify any instructions through the agency independently. The phrase can control your funds.

What if an official-looking contact asks for a remission fee?

Don’t pay. The DOJ says no fee is required to participate. Look up the relevant office independently, confirm the case, and report the impersonation if appropriate.

The Bottom Line

If recovery information may have been copied, don’t rely on a new app password. Protect the remaining assets with official wallet guidance and report unauthorized transfers.

Don’t pay anyone who invokes this case to offer you a payout. Verify the claim with the agency yourself and keep your recovery information private.