A former FBI supervisory agent allegedly stole about $1 million in cryptocurrency, mixed it with personal funds, and asked ChatGPT how to use the money and relocate to Europe. Summary Patrick Yaroch allegedly made about a dozen crypto transfers beginning in late 2024 or early 2025. Investigators said he used ChatGPT to explore investing $1 million and moving to Portugal. Yaroch allegedly booked a Sept. 3 flight to Portugal before his arrest. The FBI dismissed Yaroch on July 31, one day before the affidavit was filed. FBI agent allegedly transferred crypto using discovered keys Federal authorities arrested Yaroch on Friday over allegations that he took cryptocurrency from wallets described in court documents as “adversarial cryptocurrency accounts.” An affidavit filed on Aug. 1 said Yaroch discovered private keys that gave him access to the digital wallets. He allegedly used those keys to transfer funds to himself through roughly a dozen transactions beginning in late 2024 or early 2025. Yaroch reportedly told investigators that he was frustrated by his inability to do more to stop people connected to an “adversarial nation” from using cryptocurrency. However, prosecutors allege that he transferred the assets for his own benefit rather than through an authorized seizure or forfeiture process. The suspected theft totaled approximately $1 million, according to the affidavit. Court documents did not identify the digital assets involved or disclose the wallets from which they were allegedly taken. Yaroch later told a Department of Justice employee that he had made “some very poor decisions related to cryptocurrency wallets.” During a separate interview, he also acknowledged to federal agents that he had made a serious mistake. ChatGPT searches covered $1 million and Portugal Investigators said Yaroch mixed the disputed cryptocurrency with his personal funds and used ChatGPT to consider what to do with the money. His questions reportedly covered how to spend or invest $1 million and whether he should leave the United States for a European country. The affidavit included a response in which ChatGPT suggested Portugal based on personal details Yaroch had shared, including his family, preferred property size and interest in wine. “Given everything you’ve told me — [name of Yaroch’s child], your wife, the desire for a 2-5 hectare estate, interest in age-worthy red wine, and the goal of actually living there rather than just owning a property — I would not start by chasing citizenship,” the chatbot responded, according to the affidavit. The response then identified Portugal as its top option for Yaroch’s stated circumstances. Authorities also found that he had purchased a ticket to Portugal departing on Sept. 3, along with a return flight. The court filing does not indicate that ChatGPT knew the funds were allegedly stolen. It also does not establish that Yaroch acted on the chatbot’s financial suggestions. Former agent worked in FBI counterintelligence Yaroch served as a supervisory special agent in the FBI headquarters’ Counterintelligence and Espionage Division. He had previously worked in the agency’s Boston field office. His position could become a central part of the case because it may explain how he encountered the wallet keys and assets described in the affidavit. The filing, however, does not publicly detail how the FBI obtained the wallets or what investigation they were connected to. The FBI fired Yaroch on July 31. He was later charged with interstate transportation of stolen goods and receipt of stolen goods, securities, and money. The charges remain allegations, and Yaroch has not been convicted. Crypto custody failures face wider scrutiny The case comes as cryptocurrency security incidents renew questions about access controls and the handling of wallet credentials. Coldcard recently faced scrutiny over a five-year seed-generation flaw linked to suspected attacks involving more than 1,800 BTC across over 5,200 potential victim addresses. Galaxy Research cautioned that those figures are on-chain estimates and do not confirm that one attacker caused every loss. Separately, Ostium said an attacker compromised its off-chain infrastructure and manipulated BTC-USD price reports to drain 23.75 million USDC from its liquidity vault. The protocol said its smart contracts and governance multisigs were not breached. Yaroch’s case differs because it concerns alleged insider theft by a US law-enforcement employee rather than an external technical exploit. It nevertheless shows how access to wallet keys can bypass other safeguards when custody procedures fail.
