Ex-FBI Agent Admits $2.47M Crypto Theft Across 35 Cases

FBI crypto theft reached at least 79 wallets

The signed statement of facts describes confirmed theft, rather than a vulnerability that might have exposed funds. On pages 8 and 9, it records at least 79 wallets, at least 10 victims and proceeds matching the Justice Department’s total.

Those are separate measures. A person can control multiple wallets, and a single investigation can involve several transfers. The 35-investigation figure therefore cannot be substituted for a count of people who lost money. Similar distinctions between addresses and losses arose in the earlier Coldcard theft estimates, although that incident involved a different access mechanism.

As of November 7 at 23:00 UTC, the strongest loss evidence reviewed was the agreed statement and prosecutors’ announcement. Individual thefts ranged from 81 cents to more than $580,000. The statement records at least 10 transfers from wallets connected to victims of other crimes whose credentials were maintained in FBI case files.

Most targeted wallets were associated with investigation subjects. Others were controlled by two unnamed adversarial nation states. Yaroch also stole from at least one wallet the FBI had created and funded for an operation. The filing does not identify the foreign states by name.

That range changes the practical meaning of the case. It reaches beyond an employee diverting funds from suspected criminals: people already affected by other offenses were among those whose wallets were accessed.

The record describes a scheme beginning no later than December 2024 and continuing into July 2026. It does not establish a new public-wallet attack wave in November. Nor does the reviewed material provide a complete public transaction list from which readers could independently reconstruct every theft.

Stolen credentials crossed investigative boundaries

Yaroch worked at the FBI’s Boston Division from 2017 through early 2025 before moving to its Counterintelligence and Espionage Division. His position gave him access to systems containing cryptocurrency credentials gathered during investigations.

The statement says he searched case-management and classified systems for those credentials, moved cryptocurrency to wallets he controlled, and exchanged it for other assets. He subsequently checked bureau records to see whether the transfers had been detected.

According to prosecutors, his actions compromised investigations involving criminal groups and nation-state adversaries, as well as sources and methods used in intelligence collection. The announcement does not quantify the operational damage or identify every affected case.

The access route is central to understanding the incident. The admitted conduct relied on sensitive wallet information stored inside investigative systems. The filing does not describe Yaroch breaking a blockchain’s encryption or exploiting a newly discovered consensus flaw.

It also shows why knowledge of wallet credentials can remain financially sensitive even when collected as evidence. An investigative copy can provide another route to controlling assets. That is an access-control implication of the facts, rather than a finding that every government custody system has the same exposure.

Daily Crypto Briefs previously examined government-linked transfers to Coinbase Prime, where movement alone did not prove a sale. Here, the agreed criminal record establishes unauthorized taking, providing a different evidentiary basis from an unexplained blockchain transfer.

Prosecutors said Yaroch used some proceeds to repay debts. Between November 25, 2025, and January 13, 2026, approximately $93,082 reached one account before payments toward credit cards, a vehicle and other loans. That is a documented use of part of the proceeds, rather than a separate loss to add to the $2.47 million total.

Yaroch restitution leaves recovery questions open

The plea follows an earlier public account of a smaller theft. Unchained’s review of the August affidavit said Yaroch initially described taking less than $1 million and consented to agents moving approximately $925,426 into government wallets. Those earlier figures are not a final accounting of the larger admitted scheme.

The Block’s November 7 review of the plea agreement reported at least $2.4 million in restitution and a forfeiture judgment of at least the same amount. It also described forfeiture of roughly 1.38 million SUI, 17,990.67 USDC and account contents.

Restitution is an obligation to compensate victims; forfeiture removes specified property or proceeds. Neither number should be presented as an additional theft total or proof that money has already reached victims. Token quantities also cannot establish a fixed dollar recovery without a valuation date and distribution record.

The reviewed announcement does not provide a completed distribution schedule or a final balance still owed to each victim. It also does not establish that all cryptocurrency credentials collected in the affected investigations have been replaced or otherwise secured.

Broader sentiment remained weak. Alternative.me’s index showed 25, or Extreme Fear, when checked November 7, compared with 28 the previous day. It measures market sentiment, rather than losses or confidence in this particular investigation.

The next scheduled event is Yaroch’s March sentencing. The Justice Department says he faces up to 20 years in prison, with the sentence determined by the judge. A final recovery total, victim-payment accounting and the full operational consequences remain unclear from the materials reviewed.