[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fluE6bNCtLcF7-1p_VJmHyvsHQEd6oVIhZQut1JLBl_E":3},{"article":4,"iocs":49,"watch_terms":53,"solutions":54,"lesson":57},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"188c6851-e7fe-40db-a0b2-d3d3106d12a4","FBI agent pleads guilty to stealing $2.4 million in crypto from nation-state hackers","fbi-agent-pleads-guilty-to-stealing-2-4-million-in-crypto-from-nation-state-hack-94b8ed","Patrick Steven Yaroch, 37, is facing up to 20 years in prison on wire fraud and money laundering charges after admitting to using his position on an FBI investigative squad to steal more than $2.4 million in cryptocurrency to cover his debts.","A senior FBI agent, Patrick Steven Yaroch, has pleaded guilty to wire fraud and money laundering charges for stealing over $2.4 million in cryptocurrency. He used his position to access FBI systems and steal funds from wallets controlled by nation-state hackers and crime victims to pay off personal debts. His actions compromised multiple FBI investigations and exposed sensitive sources and methods.","FBI agent pleads guilty to stealing $2.4M in crypto from nation-state hackers and victims.","https:\u002F\u002Ftherecord.media\u002Ffbi-agent-pleads-guilty-to-stealing-from-nation-state-hackers","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Ffbi_613c45ceeb.jpg","2026-11-06T16:53:00+00:00","2026-11-06T18:00:20.689422+00:00",8,[17,20,23],{"name":18,"type":19},"nation-state hackers","threat_actor",{"name":21,"type":22},"cryptocurrency","product",{"name":24,"type":25},"FBI","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":26,"icon":28,"name":29,"slug":30},null,"Breaches","breaches",[32,34,39,44],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":21,"context":52},"malware","Stolen cryptocurrency funds",[24,21],{"controls":55,"vendors":56},[],[],{"slug":58,"title":59,"body":60,"framework_refs":61,"framework_notes":69},"fbi-agent-steals-24m-in-crypto-by-abusing-privileged-system-access","FBI Agent Steals $2.4M in Crypto by Abusing Privileged System Access","A senior FBI agent exploited his privileged access to internal FBI systems to steal cryptocurrency from wallets seized from nation-state hackers and crime victims, using the funds to pay personal debts. This case illustrates the severe risk posed by insider threats, particularly when privileged users face insufficient oversight, monitoring, and separation of duties. The breach compromised active investigations and exposed sensitive law enforcement sources and methods, demonstrating that damage from insider threats can extend far beyond financial loss. Organizations must never assume that trusted employees—especially those with elevated access—are immune to abuse of that trust.",[62,63,64,65,66,67,68],"CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","GDPR Article 32",{"GDPR Article 32":70,"MITRE ATT&CK T1566: Phishing":71,"CIS Control 8: Audit Log Management":72,"NIST SP 800-53 SI-2: Flaw Remediation":73,"CIS Control 6: Access Control Management":74,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":75,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":76},"Article 32 requires appropriate technical and organizational measures to ensure data and asset security; the absence of multi-party controls and behavioral monitoring represents a failure of organizational safeguards protecting sensitive information and assets.","More precisely, this incident maps to MITRE ATT&CK T1078 (Valid Accounts), where a legitimate insider abused valid credentials and authorized access to carry out malicious actions undetected.","Comprehensive, independently reviewed audit logs of all privileged user interactions with seized asset systems would have detected the unauthorized transactions far earlier.","NIST 800-53 also includes AC-5 (Separation of Duties) and AC-6 (Least Privilege), which directly mandate the split of responsibilities that would have blocked a single insider from completing this fraud undetected.","Enforcing least-privilege access and multi-party authorization for sensitive assets would have prevented a single agent from unilaterally accessing and transferring seized cryptocurrency.","ISO 27001 Annex A also covers access control (A.8.2) and segregation of duties (A.5.3), which would have required multi-person oversight for access to seized cryptocurrency wallets, closing the insider-abuse vector.","This control requires organizations to manage identities and enforce access controls proportionate to risk, ensuring no individual has unchecked authority over high-value digital assets."]