What charges does the FBI agent face for crypto theft?

Last verified against the public record on Aug. 4, 2026. This is a source-linked case record, not legal advice, and the docket should be checked again before citation because the case is live.

The FBI agent in the Eastern District of Virginia crypto-theft case faces two charge names: interstate transportation of stolen goods and receipt of stolen goods. Those are the charges reflected in the complaint record and repeated consistently by the major public reports reviewed for this record; no source reviewed here supplies statutory section numbers, so this record does not add them. The complaint and affidavit sit under docket gov.uscourts.vaed.602203, with the temporary detention order in the same public RECAP set.[1][2][3]

For readers comparing this record with fast-moving news accounts, that answer is deliberately narrow. The surrounding allegations are serious, and the affidavit contains unusual digital-asset evidence, but the citable charge block should not be padded with facts that are only reported, disputed, or not visible in the currently cited filings.

What the unsealed record supports

The public case record is built around three court documents: the criminal complaint, the affidavit, and the temporary detention order. The complaint supplies the charging posture, the affidavit supplies the government’s factual narrative for probable cause, and the detention order records the live custody posture after unsealing.[1][2][3]

• Confirmed from the case record: the case is in the Eastern District of Virginia under docket gov.uscourts.vaed.602203.
• Confirmed from the complaint record: the charge names are interstate transportation of stolen goods and receipt of stolen goods.
• Confirmed from the unsealed docket materials: the complaint and affidavit are public in the RECAP set, and a temporary detention order was entered after unsealing.
• Reported by NBC News: the judge was Magistrate Judge Lindsey R. Vaala, and a detention hearing was set for Aug. 4, 2026.[4]
• Reported, not treated here as a confirmed filing fact: that the cryptocurrency came from Russia. NBC attributed that point to two unnamed sources, while the complaint language described an unnamed “adversarial nation.”[4]

That last distinction matters. A complaint’s phrase “adversarial nation” and a news report’s Russia attribution are not interchangeable in a live criminal record. The Russia point may be useful context if properly sourced to NBC’s reporting, but it should not be moved into the confirmed column unless the docket itself supplies it.

The affidavit timeline

The timeline is unusually compressed. Public reporting and the unsealed record place the alleged self-report, arrest, complaint filing, unsealing, and detention sequence within roughly one week.

NBC News reported that on July 28, 2026, Yaroch contacted a Justice Department employee over Signal and also submitted an FBI online self-report form about the cryptocurrency theft. NBC, CNN, and The Block reported that he was arrested and fired on July 31, 2026. The complaint and affidavit were filed on Aug. 1, the records were unsealed on Aug. 3, and the detention-hearing date was reported as Aug. 4.[1][2][3][4][5][6]

The detention posture is therefore not a settled endpoint. The temporary detention order is a live procedural marker, not a conviction, plea, indictment, or final detention ruling. Anyone citing custody status after Aug. 4 should check the docket before relying on this version of the record.[3]

What the government says was stolen

The allegation centers on cryptocurrency in FBI-monitored wallets and agency-held seed phrases. NBC reported the exact value as $925,426.07. CNN used the broader formulation “more than $900,000,” while CoinDesk described the amount as more than $1 million. Because those are not the same assertion, the safest citable value from the available news accounts is NBC’s exact figure, while noting that other outlets rounded or framed the figure differently.[4][5][7]

The transfer count is also unstable across coverage. The Block reported that the alleged theft happened through up to a dozen transfers and tied the beginning of the conduct to late 2024 or early 2025. Other summaries describe about 10 transfers or use a different start window. The better practice is to quote the affidavit directly if a filing citation is needed, or to label the transfer count as reported when relying on news coverage.[6]

Decrypt reported that investigators recovered a Trezor hardware wallet, handwritten seed phrases, a Kraken account holding about $188,570, and ChatGPT conversation logs from Yaroch’s phone. Those are evidence-summary facts, not separate charges. They explain why the case belongs in a risk record that tracks crypto custody and AI-implicated material, but they do not change the two charge names.[8]

The ChatGPT logs are relevant, but not the case theory

The ChatGPT material deserves a place in the record because it is reported as recovered evidence. The Block and Decrypt both connected the case to ChatGPT use, including planning-related queries described in coverage. That makes the matter AI-implicated in the evidence-record sense. It does not make the case an AI-sanctions precedent, an AI-hallucination case, or proof that the model caused the alleged theft.[6][8]

For risk and KM purposes, the cleaner label is: criminal crypto-theft complaint with recovered ChatGPT logs. That label preserves the AI signal without overstating what the filings and reports establish.

Where public accounts already diverge

The charge names are the most stable part of the public record. NBC, CNN, The Block, and Decrypt all report interstate transportation of stolen goods and receipt of stolen goods. The instability begins around the surrounding facts: value, transfer count, start date, country attribution, and spelling.[4][5][6][8]

CoinDesk’s account is useful here less for any new charge information than for the verification problem it creates: it spells the defendant’s name “Yarmoch.” The public docket and the other reviewed outlets use Yaroch. A single-letter mismatch is enough to create bad downstream records when a live criminal case is being summarized into databases, newsletters, or client alerts.[7]

This is the same reason a verified-charges record should keep a hard boundary between docket facts and reported context. The site has used that format in the Demetrius Byrd verified-charges record and in the Brooklyn Bridge jump verification case: first identify the charge and procedural status from the best available record, then log conflicts without turning them into conclusions.

A usable citation block

For a memo, alert, or case note, the safest short formulation is:

Patrick Yaroch, an FBI agent charged in the Eastern District of Virginia under docket gov.uscourts.vaed.602203, faces two complaint-stage charges: interstate transportation of stolen goods and receipt of stolen goods. The complaint and affidavit were filed Aug. 1, 2026, unsealed Aug. 3, 2026, and a temporary detention order was entered the same day; a detention hearing was reported as set for Aug. 4, 2026.[1][2][3][4]

That wording does not call him convicted. It does not add statutory sections not supplied in the reviewed materials. It does not convert a reported Russia connection into a court-confirmed fact. It also leaves room for the docket to move.

For procedural-status work, the better comparison is a docket-status template such as the site’s Trump immunity case status record, not a broad AI-risk explainer. A live criminal docket needs dates, filing posture, custody status, and a last-verified timestamp more than it needs a theme.

Procedural boundary as of Aug. 4, 2026

As of the last verification on Aug. 4, 2026, the reliable answer to “what charges does the FBI agent face for cryptocurrency theft?” is limited to two charge names: interstate transportation of stolen goods and receipt of stolen goods. The case is in the Eastern District of Virginia, docket gov.uscourts.vaed.602203, with the complaint, affidavit, and temporary detention order publicly available through the cited RECAP materials.[1][2][3]

The evidence narrative is more unsettled in public coverage. The value figure, number of transfers, start date, country attribution, and one outlet’s spelling of the defendant’s name all require checking against the docket and the underlying PDFs before reuse. The charges are clear; the surrounding facts are still unstable enough that a primary-source-linked record is the only version that should be treated as citable.

References

1. Criminal complaint, CourtListener RECAP, https://storage.courtlistener.com/recap/gov.uscourts.vaed.602203/gov.uscourts.vaed.602203.1.0.pdf
2. Affidavit, CourtListener RECAP, https://storage.courtlistener.com/recap/gov.uscourts.vaed.602203/gov.uscourts.vaed.602203.2.0.pdf
3. Detention order, CourtListener RECAP, https://storage.courtlistener.com/recap/gov.uscourts.vaed.602203/gov.uscourts.vaed.602203.8.0.pdf
4. Feds charge frustrated FBI agent they say stole nearly $1 million in crypto from Russia, NBC News, https://www.nbcnews.com/politics/justice-department/feds-charge-fbi-agent-say-stole-nearly-one-million-crypto-russia-rcna590674
5. FBI agent accused of stealing nearly $1 million in cryptocurrency, CNN, https://www.cnn.com/2026/08/03/politics/fbi-agent-accused-stealing-cryptocurrency
6. FBI agent accused of stealing $1 million in crypto turned to ChatGPT for vacation plans, The Block, https://www.theblock.co/post/410491/fbi-agent-stealing-1-million-crypto-turned-to-chatgpt-vacation-plans
7. U.S. FBI Intelligence Agent Arrested in Connection With Theft of $1 Million in Crypto, CoinDesk, https://www.coindesk.com/policy/2026/08/03/u-s-fbi-intelligence-agent-arrested-in-connection-with-theft-of-usd1-million-in-crypto
8. Former FBI Agent Charged With Stealing Crypto Using ChatGPT Advice, Decrypt, https://decrypt.co/374871/former-fbi-agent-charged-stealing-crypto-using-chatgpt-advice