Tag: FBI

  • Ex-FBI Agent Charged in Alleged $1M Cryptocurrency Theft From Investigative Wallets

    Ex-FBI Agent Charged in Alleged $1M Cryptocurrency Theft From Investigative Wallets

    A former FBI supervisory special agent has been arrested and charged with stealing nearly $1 million in cryptocurrency using access obtained through a national security investigation. The case has sent shockwaves through the law enforcement and crypto communities, raising serious questions about insider abuse of sensitive investigative tools.

    Who Is Patrick Yaroch?

    Patrick Steven Yaroch previously served as a supervisory special agent in the FBI’s Counterintelligence and Espionage Division and also worked in the bureau’s Boston office. His role granted him access to sensitive information about cryptocurrency accounts that were being monitored as part of national security investigations.

    According to court records, Yaroch told a Justice Department employee that he was frustrated the FBI “could not or would not act against adversarial cryptocurrency accounts.” He reportedly said he was upset that he couldn’t do more to disrupt cryptocurrency use by an adversarial nation during an investigation.

    In an FBI affidavit, Yaroch admitted to making “some very poor decisions” and said he “went into FBI systems and found keys needed to transfer money from wallets to himself.”

    How Was the Crypto Allegedly Stolen?

    Court documents allege that Yaroch set up a personal cryptocurrency wallet in late 2024 and obtained passphrases and other wallet-access information through FBI databases. He allegedly completed between 10 and 12 transfers beginning in late 2024 or early 2025, moving digital assets into wallets under his control.

    Federal agents later searched Yaroch’s home in Ashburn, Virginia, where they recovered devices, a hardware wallet, and handwritten notes believed to contain cryptocurrency seed phrases. Authorities eventually transferred approximately $925,000 in cryptocurrency from accounts under his control into government-controlled wallets.

    Plans to Manage the Funds

    Investigators also found conversations on Yaroch’s phone in which he explored ways to invest or manage around $1 million and considered relocating overseas. Recovered records reportedly included material connected to Portugal and plans for international travel.

    An FBI spokesperson said: “The individual has since been fired from the Bureau. We hold our employees to the highest ethical standards, and this conduct is not tolerated at the FBI. We are conducting a thorough investigation in the aftermath, and as this is an ongoing matter, we will have no further comment.”

    Federal Charges and Next Steps

    Authorities said Yaroch eventually disclosed his actions to a former colleague and contacted government officials about his conduct. He now faces federal charges related to interstate transportation of stolen property and receipt of stolen property. The allegations remain unproven, and the criminal case is ongoing.

  • Microsoft’s Global Device Identifier (GDID) Tracks Windows Devices Across Networks

    Microsoft’s Global Device Identifier (GDID) Tracks Windows Devices Across Networks

    Microsoft uses a Global Device Identifier (GDID) to uniquely identify individual Windows installations across multiple services. The identifier recently drew public attention after FBI investigators used Microsoft records linked to GDID in a cybercrime investigation.

    According to a federal court filing, the GDID is a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device. Each Windows installation—whether on a physical computer or virtual machine—receives a separate identifier.

    Microsoft generates the identifier on its servers and stores it locally in the Windows registry. Researchers report that the Passport identity service receives the number before the Connected Devices Platform registers it with Microsoft’s Device Directory Service.

    The GDID typically remains unchanged during Windows updates and common system changes. However, a full Windows reinstall creates a new GDID, though Microsoft may retain earlier records linked to the previous identifier.

    The identifier appears as a 64-bit value beginning with “g:” followed by a long number. Users can view the value stored on their computer through the Windows registry or a PowerShell command.

    How GDID Connects Activity Across Microsoft Services

    GDID supports several Windows and Microsoft services, including Windows activation, Microsoft Store purchases, app licensing, Phone Link, shared clipboard functions, device telemetry, and diagnostic information. Microsoft Edge can also connect enhanced diagnostic data to the identifier when users enable that setting, potentially including browser activity and browsing history.

    Microsoft’s public documentation provides few details about GDID. An Azure Monitor reference describes GlobalDeviceId as “Microsoft global device identifier” used internally by the company. Microsoft has not published a separate support page explaining its creation, retention period, or full use.

    Zerotrace Labs examined the system by replacing a device’s existing identifier during a controlled test. Their research found that several Windows components use GDID as part of Microsoft’s wider device identity system.

    FBI Uses Microsoft GDID Records in Hacker Case

    The identifier gained attention through the case against Peter Stokes, a 19-year-old dual US-Estonian citizen. US authorities accuse him of participating in a May 2025 cyberattack against a luxury jewelry retailer.

    Prosecutors claim attackers posed as company employees and contacted the retailer’s help desk, convincing staff to reset account credentials and multi-factor authentication controls. The group allegedly obtained at least 77GB of data and demanded about $8 million in cryptocurrency.

    According to the criminal complaint, the FBI obtained GDID records from Microsoft. Investigators said the same identifier accessed an ngrok registration page when the suspected attacker created an account and later connected to the victim’s website through the same VPN proxy.

    Authorities also linked the GDID to IP addresses in Tallinn, New York, and Thailand. Travel information and social media posts reportedly placed Stokes in those locations during the relevant periods.

    Stokes was arrested in Finland and later extradited to the United States. He faces charges related to conspiracy, computer intrusion, and fraud. The allegations have not been proven, and he is presumed innocent while the court case continues.

  • FBI Arrests 21-Year-Old in Steam Malware Scheme That Stole $220,000 in Cryptocurrency

    FBI Arrests 21-Year-Old in Steam Malware Scheme That Stole $220,000 in Cryptocurrency

    A 21-year-old Florida man has been arrested for allegedly helping run a malware campaign that used malicious games on Steam to steal more than $220,000 in cryptocurrency from users. The arrest follows an FBI investigation that traced stolen funds through digital gift cards and food delivery orders.

    According to an FBI criminal complaint, the campaign operated between May 2024 and February 2026, infecting nearly 8,000 devices and compromising almost 80 cryptocurrency wallets. The malware was hidden in games uploaded to Steam, allowing attackers to gain access to victims’ systems and steal digital assets.

    The accused, Zyaire Wilkins of North Lauderdale, Florida, has been charged with conspiracy to obtain information by computer for private financial gain. If convicted, he faces a maximum sentence of 10 years in prison.

    Eight Steam Games Named in Complaint

    Investigators allege the group distributed eight malware-infected games through Steam over nearly two years. Once installed, the games deployed malware capable of accessing cryptocurrency wallets on infected computers. The games named in the complaint include:

    • BlockBlasters
    • Chemia
    • Dashverse (DashFPS)
    • Lampy
    • Lunara
    • PirateFi
    • Tokenova

    Some of the titles were removed from Steam after security concerns were reported. The FBI says the games were promoted through Discord, Telegram, X (formerly Twitter), and LinkedIn, targeting users known to own or trade cryptocurrency.

    FBI Followed Cryptocurrency Transactions

    The investigation advanced after agents traced stolen cryptocurrency used to purchase more than 150 digital gift cards through Bitrefill. According to court documents, many of those gift cards were redeemed for Uber Eats orders. Investigators used the associated phone numbers, delivery addresses, and transaction records to identify Wilkins as a suspect.

    The criminal complaint was filed in Washington state, where Valve, the company behind Steam, is based.

    Investigation Underway

    Federal agents claim that this was a team effort and that investigations are ongoing. They are trying to find more victims and establish the role played by other suspects. The FBI says this malware attack affected around 8,000 devices, accessed 80 crypto wallets, and stole at least $220,000 worth of cryptocurrency.

    Wilkins faces charges but has not been found guilty. The accusations made in the criminal complaint will be proved or refuted in court.