FBI agent Patrick Yaroch charged with stealing Bitcoin

Last verified: Aug. 4, 2026, UTC. United States v. Yaroch is, on the present record, a criminal-complaint case in the Eastern District of Virginia, not an indictment. The complaint charges Patrick Yaroch with interstate transportation of stolen goods, securities, and monies, and receipt of stolen goods, securities, and monies. The docket number is 1:26-mj-00300, and the detention order currently in the record was entered by Magistrate Judge Lindsey R. Vaala. The next event identified in the temporary detention order is an Aug. 4 detention hearing. [1][2][3]

That distinction matters because several high-interest facts are not all in the same evidentiary bucket. The court filings identify accounts associated with an “adversarial nation,” but the identification of that nation as Russia is reported by NBC News based on two sources familiar with the matter; it is not, on the materials reviewed for this record, a court-confirmed label in the charging documents. [2][4]

What the complaint actually charges

The criminal complaint is spare in the way complaints often are: it states the charged statutes and relies on the supporting affidavit for the factual showing. The operative public posture is therefore not that a grand jury has returned an indictment, and not that the government has proved the alleged theft. The operative posture is that a magistrate judge received a complaint supported by an FBI affidavit, and Yaroch was arrested and temporarily detained while the case moved toward a detention hearing. [1][2][3]

The affidavit identifies Yaroch as an FBI supervisory special agent detailed to the U.S. intelligence community. It alleges that, through investigative work beginning in November 2024, he became aware of cryptocurrency accounts tied to an “adversarial nation” and then used access to FBI systems to locate wallet keys or seed phrases connected to those accounts. [2]

From there, the affidavit describes roughly 10 to 12 transfers beginning in late 2024 or early 2025. The alleged transferred value is stated as about $925,426.07, and the affidavit also says the assets were intermingled with Yaroch’s personal funds. That last point is why the different dollar figures in this case should not be casually merged into one clean theft number. [2]

The alleged sequence in the FBI affidavit

The affidavit’s chronology starts with access, not with a blockchain mystery. Yaroch allegedly learned of the relevant accounts during investigative work in November 2024. The government’s theory is that he later used FBI systems to find wallet credentials associated with accounts of an adversarial nation, then moved cryptocurrency from those accounts into places he controlled. [2]

The alleged transfers are described as occurring in approximately 10 to 12 movements beginning in late 2024 or early 2025. The affidavit does not present those transfers as a single accidental sweep or a one-off custody error. It frames them as repeated movements, followed by intermingling with personal funds and later activity involving exchanges and wallets. [2]

The account then accelerates at the end of July 2026. On July 28 and 29, according to the affidavit, Yaroch sent Signal messages to a Department of Justice employee and then met at FBI headquarters. The affidavit reports statements that read like admissions, including that it was “eating me up inside” and “I f---ed up.” Those are affidavit-reported statements, not a plea, not testimony, and not a judicial finding. [2]

The affidavit further states that Yaroch was arrested on July 31, 2026, and fired that same day. The temporary detention order followed on Aug. 3, setting detention on a temporary basis pending the Aug. 4 hearing. [2][3]

Why the ChatGPT material is legally useful, and why it should not be inflated

The AI angle in this case is unusually concrete because ChatGPT appears in the evidentiary record itself. The Aug. 1 affidavit describes ChatGPT exchanges dated May 28 and June 4, 2026, including prompts and a response concerning Portugal. That makes the tool part of the government’s factual narrative, rather than a post-hoc news hook. [2]

The safer reading is narrow. The affidavit can support the statement that ChatGPT exchanges are quoted or described as evidence. It does not, without more, support the broader claim that ChatGPT knowingly advised a theft, knew the source of the funds, or caused the alleged conduct. The legally important fact is that the government chose to put those exchanges in its affidavit at complaint stage. [2]

For AI-risk tracking, that is enough. A federal complaint affidavit is using AI-chat material as part of probable-cause narration, alongside wallet movements, account records, seized devices, and reported statements. The evidentiary use is the point.

For comparison within this site’s Risk Digest records, the Ninth Circuit matter involving an AI-hallucinated immigration brief is another example of AI material becoming significant because it entered a court record. The fact pattern is different; the common feature is record-based verification.

The money figures are not interchangeable

The affidavit gives a seizure figure of $925,426.07 from Kraken and Slush accounts into government wallets. It also identifies approximately $165,582.49 stranded in U.S. dollars in a Kraken account, along with a Trezor hardware wallet and handwritten seed phrases. Those figures measure different things. The seized crypto figure is not the same as a remaining exchange cash balance, and the presence of intermingled funds means a reader should resist rounding the whole case into a single “nearly $1 million” shorthand unless attributing that phrase to a specific source. [2]

The difference is not pedantry. In a crypto case, the number can refer to alleged value moved, value seized, exchange balances, government-controlled wallets, fiat conversion, or commingled assets. Here, the affidavit supplies several of those categories, and they should stay separate until a later filing or order clarifies forfeiture, restitution, tracing, or ownership. [2]

Custody and docket status

The Aug. 3 temporary detention order is the custody marker currently worth using. It places Yaroch in temporary detention pending the Aug. 4 detention hearing before Magistrate Judge Vaala. It does not resolve pretrial detention on the merits for the life of the case, and it does not say what will happen after the hearing. [3]

For publication and citation purposes, the case should be rechecked against the docket before any update that uses present-tense custody language. A temporary detention order entered one day before a scheduled detention hearing is a moving-status document, not a stable endpoint. [3]

Reported claims that should remain labeled

The Russia attribution is the cleanest example of a fact that may be true and still should not be promoted to court-confirmed status. NBC reports that the “adversarial nation” was Russia, attributing that identification to two sources familiar with the matter. The affidavit, as described in the available record materials for this entry, uses the broader formulation. [2][4]

The same caution applies to any headline or summary calling the matter an indictment. The document in the record is a criminal complaint, supported by an affidavit. If a grand jury indictment appears later, that will be a new docket fact. Until then, “charged by criminal complaint” is the accurate phrase. [1][2]

The ChatGPT material also needs its label. The record supports that ChatGPT exchanges appear in the affidavit. It does not support treating the tool as a legal actor, a co-conspirator, or an adjudicated cause of the alleged theft. [2]

Where the record stands now

The current primary-source record confirms a federal complaint-stage prosecution against Patrick Yaroch in the Eastern District of Virginia, docketed as 1:26-mj-00300. The charges are interstate transportation and receipt of stolen goods, securities, and monies. The FBI affidavit supplies the alleged wallet-access and transfer narrative, the reported self-disclosure and FBIHQ meeting, the ChatGPT exchanges, and the seizure figures. The Aug. 3 order supplies the temporary detention posture and the Aug. 4 hearing date. [1][2][3]

The unresolved items should stay unresolved unless the docket supplies them: whether an indictment is returned, what happens at detention, how the government ultimately proves tracing and ownership, whether Russia is confirmed in a filing, and what legal significance, if any, later filings attach to the ChatGPT exchanges. For now, the reliable description is narrower and more useful: this is a confirmed complaint-stage federal case involving alleged cryptocurrency theft by an FBI agent, with ChatGPT exchanges appearing in the evidentiary record.

References

1. Criminal Complaint, United States v. Yaroch, CourtListener RECAP
2. FBI Affidavit in Support of Criminal Complaint, CourtListener RECAP, filed Aug. 1, 2026
3. Temporary Detention Order, CourtListener RECAP, Aug. 3, 2026
4. Feds charge FBI agent, say he stole nearly $1 million in crypto from Russia, NBC News