A former FBI agent has pleaded guilty to a crypto theft that The Defiant puts at $2.47 million. Prosecutors say Patrick Steven Yaroch used credentials tied to 35 FBI investigations, which they say compromised cases and intelligence sources and methods. The headline is a person doing something awful. The builder lesson is quieter and more useful: the weakest point in a crypto system is usually whoever holds the keys, not the code.
What was reported
Here is what the sources support, and where they stop.
- ▸The plea and the amount. The Defiant's report says Yaroch pleaded guilty to a $2.47 million crypto theft. That is the figure in its headline. We could only read the headline and summary of that piece, so everything below the summary is outside what we can confirm.
- ▸The access. According to The Defiant's summary, prosecutors say he used credentials tied to 35 FBI investigations, compromising cases and intelligence sources and methods. That is the prosecutors' account, relayed by the outlet.
- ▸Earlier reporting. Cointelegraph covered the same defendant on August 4, 2026. It described a former FBI supervisory agent who used internal systems to obtain wallet credentials linked to an adversarial country, then moved funds to his own wallets. It reported 10 unauthorized transfers between late 2024 and early 2025, roughly $1 million taken, and about $925,000 moved to government-controlled wallets with his cooperation. It also said some of the assets were deposited into the Suilend lending protocol.
The numbers don't match, and that matters
The August report says about $1 million. The November headline says $2.47 million. Maybe the plea documents count more than the early filing did. Maybe the two outlets measure different things, such as the amount taken versus the value at some later point. We can't tell from what we could read, so we won't pick one and present it as settled. Different stage, different number, and each one belongs to the outlet that printed it.
This is the same discipline we apply to any figure in the agent economy: name the stage, name the source, and don't add numbers that were never meant to be added. Primary documents, meaning the plea agreement or the Justice Department's release, are where the reconciliation will live.
Why a builder should care
Strip away the law enforcement angle and the pattern is familiar from onchain agent work:
- ▸Credentials were the asset. The reporting centres on wallet credentials obtained through internal access. Custody is a people-and-process problem as much as a cryptography problem.
- ▸Privileged access tends to be broad. Reported access spanning 35 investigations is a reminder that one login reaching many things is a design choice somebody made.
- ▸Recovery depended on cooperation. Per Cointelegraph, agents reached funds using devices and seed phrases retrieved with the defendant's help. A key you can't rotate or scope leaves you with few options when the person holding it goes wrong.
If an agent can move funds, "trust me bro" is not a custody model. The questions worth asking of any agent stack are plain ones. Who can read the keys? Is spend scoped per task or per wallet? What does revocation look like? Can an operator's access be limited without redeploying everything?
What the library gives you
When you build an agent on Sato, the wallet and payment-rail choices are part of the stack, not an afterthought. Sato Hub maps wallets, MCPs, skills and payment rails side by side, so you can compare how each handles key custody and spend limits before you wire one in. The Sato Score is a transparency and liveness signal: it tells you what is open and active, not whether something is safe, so read the custody details yourself.
What to watch
- ▸The court record. The plea agreement or sentencing filings should settle the amount and the scope of access. Until then, treat each outlet's figure as that outlet's.
- ▸Sentencing. The reporting we read doesn't give a sentencing date, so we won't guess one.
- ▸Custody practice around seized and held crypto. Cointelegraph noted earlier cases involving federal agents and Silk Road-era bitcoin. Watch whether agencies change how access to seized wallets is scoped and logged.
- ▸Your own key paths. Build the agent, then map who can touch its keys. Start at satohub.ai/build.