root@ransomvault:~$ tail -f threat_intel.log

Threat Intelligence

Former FBI Supervisor Pleads Guilty to Stealing $2.47 Million in Cryptocurrency from FBI Investigations

Darkintel Team2 min read

Patrick Steven Yaroch, a 37-year-old former FBI supervisor, has pleaded guilty to wire fraud and money laundering. He stole about $2.47 million in cryptocurrency from wallets linked to FBI investigations. He entered the guilty plea on November 5, 2026, according to the U.S. Department of Justice (DOJ).

How the theft worked
According to the FBI’s search affidavit, Yaroch accessed FBI systems that stored the seed phrases of cryptocurrency wallets belonging to investigation subjects, and memorized them. A seed phrase is a series of words, usually 12 or 24, that restores access to a cryptocurrency wallet; anyone who has it can potentially control the funds.

Starting no later than December 2024, Yaroch made about 100 transfers using credentials tied to 35 separate investigations. The targeted wallets belonged to people under FBI investigation, including adversarial nation-state actors. He moved the funds to a personal wallet on his own device, then swapped the assets into other currencies and made further transactions to hide where they came from. According to the DOJ, his actions compromised multiple investigations.

Motive and use of the funds
The affidavit says Yaroch justified his actions as frustration that the FBI was not moving quickly enough against the wallets’ criminal owners, so he decided to take matters into his own hands. However, the DOJ says he also used some of the proceeds to pay personal debts, including credit cards, car payments, and other loans. The affidavit also shows he asked ChatGPT how to invest a million dollars and where to live in Europe. After it suggested Portugal, he began setting up a life there.

Self-reporting and arrest
According to the affidavit, Yaroch confessed to a former DOJ colleague, saying his actions were “eating him up inside.” The colleague urged him to self-report, and he did. The FBI placed him on leave and fired him two days later. Agents then searched his home with a warrant and seized assets, including his phone, which had access to a Kraken cryptocurrency account, and a piece of paper containing the seed phrases for his own wallet.

A recurring pattern
This is not the first time a federal agent has stolen cryptocurrency held as evidence:

  • December 2024: Former Secret Service agent Anthony Joseph Evans pleaded guilty to stealing cryptocurrency worth $56,000 from a hardware wallet held in the agency’s secure evidence vault.
  • 2015: Former Secret Service agent Shaun W. Bridges pleaded guilty to money laundering and obstruction of justice after stealing bitcoin during the Silk Road investigation. He used another person’s administrator account to reset users’ passwords and move bitcoin into a wallet he controlled. The bitcoin was worth about $350,000 at the time; he later sold it for $820,000.

Why it matters: the insider threat
This case shows how dangerous a trusted insider with privileged access can be. Seed phrases stored in readable form in internal systems gave Yaroch everything he needed: he didn’t have to steal a device or bypass technical controls, only remember a list of words. Cryptocurrency also moves instantly and is hard to reverse, so stolen funds can be laundered quickly.

Newsletter

Get the latest cyber news in your inbox

Ransomware, breaches and exploited vulnerabilities, delivered by RansomVault.

Free. No spam. Unsubscribe in one click.

Latest news

How PHP2Shell Works, and Why It Gives Attackers Access Before Your Code Even Runs

Knowledge

PHP2Shell, the pair of critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, has become one of the most heavily exploited bugs of the year. It was exploited four days before PHP released patches on October 21, added to CISA’s Known Exploited Vulnerabilities catalog, and most recently used to break into Check Point Security Gateways and wipe VMware ESXi hosts. But how does it actually work? This post explains the vulnerability in plain terms, using technical research on th

FAA Grounds All U.S. Flights Over Nationwide Air Traffic Control Communications Failure

Threat Intelligence

On Friday afternoon, the Federal Aviation Administration (FAA) ordered a nationwide ground stop at every U.S. airport, citing "extraordinary circumstances" and safety concerns. U.S. Transportation Secretary Sean Duffy said a communications problem was affecting all Air Route Traffic Control Centers across the country. "FAA technicians are investigating the issue. We will provide immediate updates as we have them," Duffy wrote on X. Departing flights must stay on the ground until further noti

PHP2Shell Attacks on Check Point Gateways Deploy Data Wiper on VMware ESXi Hosts

Zero-Day / Threat Intelligence

Threat actors are exploiting vulnerable Check Point Security Gateways in a campaign that ends with data-wiping malware on VMware ESXi hosts. According to Check Point Research, the attacks began on October 30, 2026, first against Israeli organizations. A single actor ran the whole operation, from initial access to lateral movement and destruction. Background: PHP2Shell PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remo