A former FBI supervisory agent allegedly stole about $1 million in cryptocurrency, mixed it with personal funds, and asked ChatGPT how to use the money and relocate to Europe.

FBI agent allegedly transferred crypto using discovered keys

Federal authorities arrested Yaroch on Friday over allegations that he took cryptocurrency from wallets described in court documents as “adversarial cryptocurrency accounts.”

An affidavit filed on Aug. 1 said Yaroch discovered private keys that gave him access to the digital wallets. He allegedly used those keys to transfer funds to himself through roughly a dozen transactions beginning in late 2024 or early 2025.

Yaroch reportedly told investigators that he was frustrated by his inability to do more to stop people connected to an “adversarial nation” from using cryptocurrency. However, prosecutors allege that he transferred the assets for his own benefit rather than through an authorized seizure or forfeiture process.

The suspected theft totaled approximately $1 million, according to the affidavit. Court documents did not identify the digital assets involved or disclose the wallets from which they were allegedly taken.

Yaroch later told a Department of Justice employee that he had made “some very poor decisions related to cryptocurrency wallets.” During a separate interview, he also acknowledged to federal agents that he had made a serious mistake.

ChatGPT searches covered $1 million and Portugal

Investigators said Yaroch mixed the disputed cryptocurrency with his personal funds and used ChatGPT to consider what to do with the money.

His questions reportedly covered how to spend or invest $1 million and whether he should leave the United States for a European country. The affidavit included a response in which ChatGPT suggested Portugal based on personal details Yaroch had shared, including his family, preferred property size and interest in wine.

“Given everything you’ve told me — [name of Yaroch’s child], your wife, the desire for a 2-5 hectare estate, interest in age-worthy red wine, and the goal of actually living there rather than just owning a property — I would not start by chasing citizenship,” the chatbot responded, according to the affidavit.

The response then identified Portugal as its top option for Yaroch’s stated circumstances. Authorities also found that he had purchased a ticket to Portugal departing on Sept. 3, along with a return flight.

The court filing does not indicate that ChatGPT knew the funds were allegedly stolen. It also does not establish that Yaroch acted on the chatbot’s financial suggestions.

Former agent worked in FBI counterintelligence

Yaroch served as a supervisory special agent in the FBI headquarters’ Counterintelligence and Espionage Division. He had previously worked in the agency’s Boston field office.

His position could become a central part of the case because it may explain how he encountered the wallet keys and assets described in the affidavit. The filing, however, does not publicly detail how the FBI obtained the wallets or what investigation they were connected to.

The FBI fired Yaroch on July 31. He was later charged with interstate transportation of stolen goods and receipt of stolen goods, securities, and money.

The charges remain allegations, and Yaroch has not been convicted.

Crypto custody failures face wider scrutiny

The case comes as cryptocurrency security incidents renew questions about access controls and the handling of wallet credentials.

Coldcard recently faced scrutiny over a five-year seed-generation flaw linked to suspected attacks involving more than 1,800 BTC across over 5,200 potential victim addresses. Galaxy Research cautioned that those figures are on-chain estimates and do not confirm that one attacker caused every loss.

Separately, Ostium said an attacker compromised its off-chain infrastructure and manipulated BTC-USD price reports to drain 23.75 million USDC from its liquidity vault. The protocol said its smart contracts and governance multisigs were not breached.

Yaroch’s case differs because it concerns alleged insider theft by a US law-enforcement employee rather than an external technical exploit. It nevertheless shows how access to wallet keys can bypass other safeguards when custody procedures fail.

A supervising U.S. FBI agent who worked in intelligence at the national headquarters has been arrested and accused in a federal court filing of stealing more than $1 million in cryptocurrency.

The high-level special agent, identified as Patrick Steven Yarmoch, allegedly turned himself in to agency colleagues, reporting that he dug crypto keys from FBI systems to make as many as a dozen transfers to himself from accounts tied to foreign individuals he’d investigated, according to an August 1 account filed with the U.S. District Court for the Eastern District of Virginia.

Yarmoch — who held a “top secret” security clearance — had worked in counterintelligence, specifically with an investigative unit that focused on an unnamed “adversary nation,” according to the court filing, which noted he was suspended for a couple of days before being fired and arrested on July 31.

The resident of Ashburn, Virginia, had worked as a supervisory special agent at FBI headquarters in Washington, specifically in its counterintelligence and espionage division. He’d previously worked for years out of Boston, where he’d been in a national-security unit investigating the adversary nation referenced in the court filing.

FalconX, the digital-asset prime broker that acquired 21Shares last November, has reportedly cut about 10% of its workforce as it braces for what Bloomberg describes as a prolonged downturn in crypto markets. The staff reduction, reported Monday, comes as the firm looks to refocus its business and tighten spending across key regions.

According to people familiar with the matter cited by Bloomberg, FalconX is also reshaping its Singapore strategy—shifting emphasis toward crypto derivatives trading—and plans to withdraw its license application with the Monetary Authority of Singapore (MAS). Bloomberg further reported that the company intends to keep a presence in Asia while expanding its European operations.

Key takeaways

• Bloomberg reports FalconX has reduced roughly 10% of staff as the firm anticipates a longer-than-expected crypto market slump.
• FalconX is reportedly pivoting in Singapore toward crypto derivatives and intends to withdraw its MAS license application.
• The workforce cut affects staff across multiple markets, after FalconX previously had around 350 employees in the US, UK, Singapore, and Hong Kong.
• FalconX’s move aligns with broader industry cost reductions seen across exchanges and crypto service providers during the downturn.
• The report highlights a wider sector shift from pure spot trading toward derivatives and tokenized asset products.

Workforce cuts and a broader corporate reset

Bloomberg, citing people familiar with the matter, said FalconX carried out the layoffs as part of preparations for what it described as an extended downturn. Before the reduction, the company employed about 350 people across the United States, the United Kingdom, Singapore, and Hong Kong, according to the report.

Bloomberg also noted that FalconX is reshaping its strategy in Singapore by placing more focus on derivatives-related activity. At the same time, the firm is reportedly preparing to withdraw its license application with MAS, signaling that it expects its Singapore roadmap to change materially rather than waiting for approval.

Cointelegraph reached out to a FalconX spokesperson for comment but did not receive an immediate response.

Singapore licensing changes signal a strategic pivot

The decision to withdraw a licensing application—if confirmed—marks a tangible adjustment to FalconX’s approach in Singapore. Rather than pursuing the planned regulatory pathway, the firm is reportedly moving toward a derivatives-focused business model while maintaining its wider regional footprint.

Bloomberg’s report also suggested that FalconX plans to keep operating in Asia, but with a different emphasis, while expanding in Europe. For investors and counterparties, these kinds of shifts can affect how firms allocate liquidity, structure partnerships, and manage regulatory risk across jurisdictions.

FalconX’s earlier acquisition of 21Shares in November also frames the importance of this period: prime brokerage activity and related capital markets services can be highly sensitive to trading conditions, volatility, and institutional engagement—variables that tend to soften during extended bear-market stretches.

Industry downsizing grows as trading volumes cool

The reported workforce reduction adds FalconX to a broader list of crypto businesses scaling back operations during the market downturn. Bloomberg’s report places the company alongside moves already seen from exchanges and infrastructure providers, including Coinbase, Crypto.com, Luno, Gemini, and BitGo, according to references cited in the original coverage.

While the scale and reasons vary by firm, the pattern is consistent: when spot activity and retail participation weaken, businesses often reduce headcount and reallocate resources toward segments that may hold up better—such as derivatives, institutional services, and tokenized real-world asset products.

Exchanges increasingly lean on derivatives and tokenized products

Pressure on exchanges has been building as Bitcoin and other digital assets retreated from last year’s highs, weighing on trading volumes and retail engagement. Earlier coverage from Cointelegraph cited analysts who believe Bitcoin may not yet have reached a market bottom, implying that the broader industry could face continued headwinds.

At the time of the original reporting, Bitcoin was last trading below $64,000—about 50% under its October peak above $126,000. In such conditions, many platforms appear to be searching for revenue resilience beyond spot trading.

CoinGecko data referenced in the original article suggests that the “crypto TradFi” sector—covering tokenized assets, derivatives, and traditional finance-style products—grew fivefold to $6.6 billion between January 2025 and June 2026. Tokenized stocks and commodities were described as leading contributors to that expansion.

Coinbase’s most recent earnings, as referenced in the original coverage, also underscored how the mix can shift during a downturn. Even though the company missed earnings expectations, it reported that 88% of second-quarter net revenue came from businesses other than spot Bitcoin trading, with derivatives, prediction markets, and tokenized assets playing a more prominent role.

Taken together, these developments point to a central industry tension: spot-driven revenue models can be difficult to sustain in extended drawdowns, while firms with deeper derivatives distribution, tokenization services, or institutional market-making capabilities may have more levers to manage through volatility cycles.

What to watch next is whether FalconX’s reported Singapore licensing withdrawal and derivatives emphasis translate into measurable growth in activity—or whether the company’s European expansion becomes the next major operational focus. For the wider market, the key signal will be how quickly trading ecosystems shift their revenue dependence away from spot as conditions remain uncertain.

FalconX, the digital-asset prime brokerage that acquired crypto ETF issuer 21Shares in November, has laid off about 10% of its workforce as it braces for a longer crypto market downturn, Bloomberg reported Monday.

Bloomberg, citing people familiar with the matter, also said the firm is reshaping its Singapore approach—shifting emphasis toward crypto derivatives trading and planning to withdraw its license application with the Monetary Authority of Singapore. The company intends to keep a presence in Asia while expanding its business in Europe.

Key takeaways

• FalconX reportedly cut roughly 10% of staff amid expectations of an extended downturn, according to Bloomberg.
• The firm is reportedly pivoting its Singapore strategy toward crypto derivatives while preparing to withdraw its MAS license application.
• FalconX plans to maintain operations in Asia but is looking to grow its footprint in Europe, Bloomberg said.
• The move aligns FalconX with other crypto firms that have reduced headcount during the market slowdown.
• Broader exchange activity is shifting beyond spot trading toward derivatives and tokenized real-world assets, CoinGecko and Coinbase reporting suggest.

FalconX cuts staff as it plans a longer runway

Before the layoffs, FalconX employed about 350 people across the United States, the United Kingdom, Singapore, and Hong Kong, Bloomberg said. The report frames the cuts as part of a broader effort to operate through what it describes as a prolonged market slump.

Cointelegraph reached out to FalconX for comment but did not receive an immediate response.

Strategic pivot in Singapore, expansion in Europe

Beyond the workforce reduction, Bloomberg reported that FalconX is changing course in Singapore. The company is reportedly concentrating on crypto derivatives trading there, while planning to withdraw its license application with the Monetary Authority of Singapore.

While that withdrawal would mark a significant shift in its regulatory posture, Bloomberg also said FalconX expects to remain active in Asia. At the same time, the firm intends to expand its European operations—suggesting management is reallocating risk and resources toward regions it believes can better support its near- to mid-term growth plans.

Part of a wider wave of crypto downsizing

FalconX’s reported cuts add to a growing list of crypto companies scaling back operations during the downturn. Bloomberg’s report places FalconX alongside headcount reductions at exchanges and infrastructure providers mentioned by Cointelegraph, including Coinbase, Crypto.com, Luno, Gemini, and BitGo.

The shared theme is not just lower demand for trading products during a market cool-off, but also an industry-wide reassessment of costs, regulatory exposure, and product focus—particularly as volumes and retail participation tend to soften when asset prices pull back from prior peaks.

Exchanges broaden beyond spot as tokenized finance grows

Market pressure has been felt across trading venues. With Bitcoin and other digital assets retreating from last year’s highs, exchanges have seen trading volumes and retail engagement weigh on performance, and some analysts have argued that the market may still be finding its base rather than having fully bottomed.

Cointelegraph previously noted that some market participants believe Bitcoin has not yet reached a market bottom. At the time of the earlier reporting referenced in the source material, Bitcoin was trading below $64,000—about 50% under its October peak above $126,000.

In response, many exchanges are pushing into areas that can support activity even when spot momentum fades. CoinGecko, as cited in the source, reported that the “crypto TradFi” sector—which includes tokenized assets, derivatives, and other traditional finance products—grew fivefold to $6.6 billion between January 2025 and June 2026. That growth profile points to a strategic shift toward revenue streams less dependent on purely spot-driven cycles.

Coinbase’s latest earnings, cited in the source, also illustrate how some major platforms are positioning around products beyond spot Bitcoin trading. While Coinbase missed earnings expectations, it reported that 88% of second-quarter net revenue came from businesses other than spot Bitcoin trading, with derivatives, prediction markets, and tokenized assets cited as increasingly important contributors.

For FalconX, the reported emphasis on derivatives in Singapore fits this broader industry pattern: when spot trading slows, derivatives and structured products can help sustain engagement from more sophisticated participants and hedgers. However, the operational implications of withdrawing a license application—while still planning to operate in the region—will be something investors and clients may want to watch closely, since regulatory access can materially affect product availability and timelines.

Going forward, readers should monitor two things: whether FalconX’s European expansion accelerates in tandem with the Singapore changes, and how the firm’s reported shift toward derivatives aligns with the wider migration toward tokenized and TradFi-linked offerings as the market’s next phase remains uncertain.

A new ransomware group is threatening to leak contact details of over 100,000 UK police officers after stealing data from government departments, including the Ministry of Defence (MoD), the Home Office, the National Crime Agency (NCA), and the Crown Prosecution Service (CPS).

The Times confirmed that a dark web listing from the group, known as ExfilSquad, in late July was legitimate, and that it had leaked the full names, email addresses, area of work details, and more, of over 100,000 staff listed on the Police National Legal Database (PNLD). 

Police revealed that the data of 114,000 PNLD subscribers were leaked, and that most of these individuals were police officers.

The leak also included data from 2,615 CPS staff, 617 Home Office employees, 588 NCA staff and 402 MoD personnel 

In all, ExfilSquad claimed to have hacked 15 firms and government bodies, including Microsoft and the UK’s Department for Education.

It had claimed that 135,000 law enforcement records were stolen, but the validity of these claims was reportedly doubted by researchers when it was listed. 

Read more: Iranian hackers suspected of attacking 30 Minnesota water companies

The ExfilSquad page reads, “Once your company’s data is posted here, it’s NEVER leaving the public eye and it will be passed around the internet FOREVER. The payment we request of you is simply a rounding error compared to the litigation costs of your data leaking. Be smart and just pay.”

Hacked firms were given until August 5 to contact ExfilSquad, with The Times reporting that the hack appears to be financially rather than politically motivated. 

ExfilSquad will likely demand a cryptocurrency-based ransom as, like most ransomware and hacker groups, it can move the crypto into mixers, privacy coins, and unregulated exchanges in order to launder the stolen gains. 

Iranian hacking collective CyberAv3ngers, which allegedly disrupted the services of 30 Minnesota water firms last week, has previously tried to sell illegally obtained data for BTC.

The UK is currently planning to ban public sector bodies from paying ransomware groups in a bid to make hacking government bodies unattractive for criminals. 

Leaked data from these attacks can be used in a variety of ways to orchestrate targeted attacks against officials. Indeed, in 2025, a French tax official was arrested after she was found to have used government software to leak the data of prison officials and crypto specialists to criminals. 

A court later denied her request to be released from prison after she tried to argue that she didn’t know who the criminals were. 

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

Mastercard has completed its acquisition of stablecoin infrastructure provider BVNK, bringing on-chain payment technology into its global network.

Mastercard closes deal for BVNK

Mastercard confirmed on Aug. 3 that it had completed the acquisition of BVNK, expanding its infrastructure for moving value between fiat currencies and digital assets. The payments company first announced the agreement in March, valuing the transaction at up to $1.8 billion, including $300 million in contingent payments.

BVNK provides the underlying infrastructure for businesses and financial institutions to hold, move, manage, and convert money across traditional banking systems and blockchain networks. Its APIs support stablecoin payments, cross-border transfers, payouts, settlements, and treasury operations.

Mastercard said integrating that technology will help connect payment systems that currently operate across separate fiat and blockchain rails.

“Digital currencies — particularly stablecoins — are increasingly addressing real-world needs in areas like cross-border B2B payments, remittances, payouts, settlement and treasury flows,” Mastercard chief product officer Jorn Lambert said.

Lambert added that the company expects fiat currencies, stablecoins, tokenized deposits, and other forms of value to coexist within a connected payment system.

Why BVNK strengthens Mastercard’s stablecoin business

The acquisition gives Mastercard direct control over infrastructure that businesses can use to move between fiat money and blockchain-based assets. That could help the card network provide stablecoin services without requiring clients to build their own on-chain systems.

BVNK operates from London and San Francisco and has spent years securing licenses in multiple jurisdictions. When Mastercard announced the agreement in March, Lambert said buying the company would allow it to enter the market faster than developing comparable technology internally.

The platform’s use cases extend beyond crypto trading. Stablecoins can support round-the-clock settlement, international business payments, remittances, and treasury transfers without relying entirely on traditional correspondent banking channels.

BVNK previously received backing from Concentric, Tiger Global, Haun Ventures, Visa Ventures, Citi Ventures, and Coinbase Ventures.

“When we first invested, stablecoins were far from the financial mainstream,” Concentric co-founder and managing partner Kjartan Rist said.

Rist said the investor viewed stablecoins as an opportunity to rebuild the infrastructure supporting global payments.

Mastercard expands beyond traditional card payments

The BVNK deal forms part of a wider effort by Mastercard to secure a role in blockchain-based commerce.

Mastercard joined Visa, Coinbase, and more than 140 other businesses in June to support Open Standard, a consortium preparing to issue the dollar-pegged Open USD stablecoin. The proposed token will allow businesses to mint and redeem Open USD without fees or volume limits, while participating companies will share earnings from its reserves after management costs. The consortium intends to make stablecoin payments cheaper and easier to scale.

Mastercard also launched Agent Pay for Machines in June with support from more than 30 companies, including Coinbase, Ripple, BVNK, and the Solana Foundation. The service is designed for autonomous software agents conducting high-volume, low-value transactions across cards and stablecoins. Mastercard said users can apply authorization controls and settlement conditions to automated payments.

Together, the initiatives position stablecoins as an additional payment rail within Mastercard’s network rather than a separate system competing only with cards.

What comes next for the BVNK integration

Mastercard must now integrate BVNK’s technology, licenses, and business relationships into its broader payments network. The company has not provided a detailed rollout schedule or disclosed whether BVNK will continue operating under its existing brand.

The transaction also adds another major payment company to the competition over stablecoin infrastructure. Mastercard and Visa are both developing services that connect regulated financial institutions with blockchain settlement systems as U.S. rules give payment providers a clearer framework for using dollar-backed tokens.

Mastercard shares closed Monday at $570.97, down about 0.4%, suggesting the acquisition’s completion produced little immediate reaction from investors.

More than 4,585 BTC wallet owners are victims of Coinkite’s firmware bug and its compromised Coldcard hardware wallets, including devices with and without passphrases.

At time of writing, no one has publicly confirmed the identity(ies) of the hacker(s).

If you’re a victim, it is important to take immediate action to protect any remaining funds and document your loss for legal and criminal procedures.

The flaw traces to faulty firmware (on-device software) on Coldcards from March 2021 through late last week. Thousands of customers bought and trusted the devices to secure untold sums of money.

Founder Rodolfo Novak, known as “NVK,” apologized on social media, saying, “I’m sorry and I’m devastated,” pledging Coinkite is “committed to working with affected users who want to pursue a police report, insurance claim, or their own investigation.”

Coldcard victims should report to law enforcement

US residents can always call their local police department to file a complaint. Formal local police reports are important for many reasons, since a report often precedes insurance claims or civil suits. 

Although police departments vary in crypto expertise by location, anybody making a complaint will need to provide any evidence that a police officer requests, such as transaction IDs, the drained addresses, balance screenshots, receipts, or a written timeline.

When filing the report, ask the police officer whether you should also file a complaint with the FBI, or whether they will submit one on your behalf.

The FBI’s Internet Crime Complaint Center, IC3, is the primary federal intake point for crypto theft. Victims of the Coldcard hack may access https://complaint.ic3.gov and submit their documentation.

Victims over the age of 60 who have visual difficulty accessing this website can also call the FBI’s Elder Fraud Hotline at (833) 372-8311.

Again, residents of any municipality may ask for assistance from their local police officer.

Beware fake ‘law enforcement’ inquiries

IC3 states it “does not work with any non-law enforcement entity, such as law firms or crypto services, to recuperate lost funds,” and warns it “will never directly contact victims for information or money.” 

Don’t trust any unsolicited inbound call, text, email, or other message from someone claiming to work for the FBI or IC3. Victims should initiate a report themselves, not respond to an unsolicited inquiry from someone who might be faking credentials.

After submitting these police and FBI report(s), sophisticated victims may consult their attorney as to the suitability of their loss for filing a fraud report at https://reportfraud.ftc.gov regarding Coinkite’s advertising or business practices. 

Victims should also consult their tax professional or attorney regarding the suitability of documenting or timestamping evidence of their loss for IRS tax forms.

Protos doesn’t offer legal or tax advice. Please consult a licensed professional for personalized legal advice that suits your individual situation.