2026-08-01 · Illicit Finance
The United States government seized a hardware wallet holding thousands of bitcoin and could not open it. Two months later the defendant’s brother emptied eight of those wallets from somewhere else entirely, and sent a text message that explains the whole asset class.
Case file
| Field | Value |
|---|---|
| Matter | United States v. Gary James Harmon |
| Court | D.D.C., Chief Judge Beryl A. Howell |
| Docket | 1:21-cr-00433 (BAH) |
| Related | United States v. Larry Dean Harmon, D.D.C. 1:19-cr-00395 (BAH) |
| Device | A Trezor One, seized 6 February 2020, holding 16 bitcoin wallets |
| Why it could not be opened | Secured with the device’s passphrase feature. The government had the hardware, not the secret |
| Taken | 712.6003 BTC, approx. $4,881,532.40 at the time, moved 19 to 24 April 2020 |
| Left behind | 4,168.9815353 BTC, approx. $40m, later handed to the government |
| Laundered through | Wasabi Wallet and ChipMixer |
| Plea | Guilty, 6 January 2023 |
| Sentence | 51 months, concurrent on Counts 1 and 2, credit from 28 July 2021 |
| Judgment | 27 April 2023 |
| Posture as of 1 August 2026 | Convicted and sentenced. No appeal on the docket read |
What the record shows
On 3 December 2019 a federal grand jury in the District of Columbia returned a sealed indictment against Larry Dean Harmon, charging conspiracy to launder monetary instruments under 18 U.S.C. § 1956(h), operating an unlicensed money transmitting business under 18 U.S.C. § 1960(a), and money transmission without a licence under D.C. Code § 26-1023(c). Harmon ran Helix, a bitcoin mixing service. The indictment carried a forfeiture allegation covering all proceeds of the operation.
Helix laundered at least 354,468 bitcoin, roughly $311 million at the time of the transactions, charging about 2.5% per transaction. Blockchain analysis identified 16 bitcoin wallets holding approximately 4,877 bitcoin traced to the service.
Larry Harmon was arrested on 6 February 2020. In searches carried out alongside the arrest, agents seized several cryptocurrency storage devices, among them a Trezor One hardware wallet. All 16 wallets were on it.
The device the government could not open
The government’s sentencing memorandum in the later case against his brother states the position without embellishment:
Larry Harmon had secured the funds using the “passphrase” functionality of the device. Because the government did not have the passphrases, it could not access and transfer the funds contained on Trezor One.
A Trezor passphrase is not the device PIN. It is an additional secret, entered at unlock time, which is combined with the recovery seed to derive an entirely separate set of wallets. It is never written to the device. Nothing in the hardware records that it exists. Enter a different passphrase and you get a different, equally valid set of wallets, with no way to tell from the device which one is the real one, or whether any of them are.
That is why seizing the Trezor accomplished nothing. The government held a box.
The warning, given in open court, on the record
At Larry Harmon’s detention hearing in the Northern District of Ohio on 11 February 2020, IRS Special Agent Jeremiah Haynie testified about exactly this problem. The information needed to access bitcoin, he explained, can be copied in more than one place: onto multiple hardware devices, written down as a seed key, or simply memorised.
On cross-examination he went further. Harmon, he agreed, “could also have copies of those Trezors or those hardware wallets with family, friends, places that we didn’t search.” He also said it was likely there were storage devices the government had not recovered.
Gary Harmon was in the room. He attended his brother’s detention hearing in person. He attended the detention appeal in the District of Columbia on 13 March 2020 as well, where the government told the court it still had not been able to secure the contents of the seized Trezor devices.
Larry Harmon was released on conditions. One of them was typed into the order in capital letters: “NO CRYPTO-CURRENCY TRANSACTIONS TO BE CONDUCTED BY DEFENDANT.”
Five days in April
In April 2020, Gary Harmon obtained his brother’s credentials for the wallets on the Trezor. He used them to recreate eight of those wallets. Recreate, not access: with the seed and the passphrase, the wallets can be regenerated anywhere, on any compatible device or piece of software, without the original hardware being involved at all.
Between on or about 19 April and on or about 24 April 2020 he transferred the contents of those eight wallets into new bitcoin wallets the government had never seen. 712.6003 bitcoin, worth approximately $4,881,532.40 at the time.
Every one of those transactions was public. The government watched the money move on the blockchain and could do nothing about it.
On 22 April, in the middle of the transfers, Gary Harmon messaged an associate: “Drunk and moved way to much.” The associate, reading it as a driving risk, expressed concern. He replied that he would not drive, and added:
I’m the only one with the passphrass.
The government initially concluded that Larry had moved the coins in breach of his release conditions, and filed an emergency motion, stating its belief that “either [Larry] Harmon or a close associate acting at his direction are moving illicit proceeds from Helix in an attempt to further conceal the proceeds from the government.” Facing detention, Larry Harmon agreed to transfer the remaining eight wallets, 4,168.9815353 bitcoin, approximately $40 million at the time, to the government for the duration of the proceedings.
The 712.6003 bitcoin his brother had taken stayed gone.
What happened afterwards
Gary Harmon laundered the stolen bitcoin through two mixing services, Wasabi Wallet and ChipMixer, and spent on the pattern these cases always follow. He pleaded guilty on 6 January 2023. The government calculated a guidelines range of 51 to 63 months and asked for at least the middle of it. Chief Judge Howell sentenced him to 51 months, concurrent on both counts, with credit for time served in pretrial detention since 28 July 2021.
His brother, who ran the mixer that generated all of it, was sentenced to 36 months.
What I think happened
Every hardware wallet on the market is sold on a promise about possession. Your keys never leave the device. The device is in your hand, in your safe, in your drawer. Possession is the security model, and the marketing photographs are all photographs of an object.
This case is the cleanest refutation of that model I have ever read, and it comes from the side you would least expect. The party holding the device was the United States government. It had the hardware, a forfeiture allegation, a grand jury indictment, and the full apparatus of federal law enforcement. It had the object. It got nothing.
Meanwhile a man with a passphrase, no hardware, and by his own account a drink in him, moved $4.88 million over five days from somewhere the government was not looking.
Possession of the device is not possession of the assets. It never was. The device is a convenience for holding a secret. The secret is the asset. Once you understand that, most of the industry’s product marketing reads differently, and so does most people’s storage plan.
The second thing is about the passphrase itself, and it is the part I would want anyone reading this to sit with.
The passphrase feature is sold as an upgrade. Turn it on and your seed phrase alone is no longer enough. Somebody who finds your backup, steals your device, or coerces you into handing over twelve words still gets nothing, because the words derive a wallet that is not the one holding your money. As a defence against theft of the physical thing, it works, and this case is the proof: it worked against a federal seizure.
But look at what it does to the shape of your risk. It converts a theft problem into a knowledge problem. Before, the question was who can get their hands on your device or your backup. Afterwards, the question is who knows the phrase. Those are not the same question and they do not have the same defences. You can put a device in a safe. You cannot put a memory in a safe. You cannot audit who else has it, you cannot see it being copied, and you cannot revoke it. The only way to un-tell someone a passphrase is to move every coin to a new wallet, and to do that you have to notice first.
Gary Harmon’s five words are the entire lesson: I’m the only one with the passphrass. He was wrong about being the only one, in the sense that his brother knew it too. He was right about what mattered, which is that anyone in that set could act unilaterally, from anywhere, without the others knowing until they looked at the chain.
The third thing is the one I find hardest to shake. The government was warned, in open court, by its own agent, before any of this happened. Agent Haynie said plainly that the secret could be on other devices, written down, or memorised, and that copies could be with family or friends in places nobody had searched. It is in the transcript. And it changed nothing, because there was nothing to change. You cannot rekey somebody else’s wallet. Once the secret is out, knowing that it is out buys you the ability to watch.
That is the situation every self-custodying holder is actually in with respect to anyone who has ever known their passphrase, or been in a position to learn it. An ex-partner. A business partner. A family member you set up a backup with in a sensible mood five years ago. There is no revocation. There is only migration, and only if you think to do it.
Two things I will not claim. I will not say hardware wallets are a bad idea, because they are not: they solve key extraction and they solve it well, and this whole case turns on the fact that the passphrase feature worked exactly as designed. And I will not pretend the lesson here is that criminals are careless. Larry Harmon’s key management was, on the narrow technical question, excellent. It defeated a federal seizure. It failed on the human question, which is the one that decides these things.
What would have changed the outcome
The transferable question is not how to keep the government out. It is how to make sure that no single person, including you, can move everything alone and without anyone noticing.
Worth answering about your own arrangement, and worth answering out loud with whoever else is involved:
- Who knows the secret? Not who has the device. Who could reconstruct the wallet from what is in their head or their filing cabinet. Write the list down. If the list has ever been longer than it is now, and nobody has migrated since, the old list is still the real one.
- Could you tell? If someone recreated your wallets and moved the balance, how would you find out, and how long would it take? Gary Harmon’s transfers were public the moment they happened. Being visible on a blockchain is not the same as being seen.
- Does moving material value require a second party? A 2-of-3 arrangement, a co-signer, or a custodian with an authorisation process each convert a unilateral action into a conversation. This is the single highest-value change available and almost nobody makes it until after something happens.
- Is the passphrase written down anywhere, and does anyone else know where? A memorised passphrase with no backup is one head injury away from what happened to QuadrigaCX’s account holders. A passphrase in the same box as the seed phrase is decoration. Both failure modes are common and they pull in opposite directions, which is why this needs a decision rather than a default.
- Have you tested a recovery? Not read about one. Performed one, from the backup, onto a clean device, and then destroyed the test wallet.
For holders whose position is large enough that the answer to “who could move this alone” matters, the structural version is an independent qualified custodian, where authority to move assets sits in a documented process with more than one party in it rather than in one person’s memory. DAG coordinates that arrangement with third-party custodians and works through the key-control questions above as part of it, which is what the coordination role covers.
State the limitation with the benefit, because this case cuts both ways. Moving to a custodian removes the single-secret problem and replaces it with counterparty risk at the custodian, which is its own live failure mode and the subject of the Prime Trust article in this cluster. As DAG’s own disclosure puts it, custody arrangements with third-party independent qualified custodians reduce certain risks but do not eliminate them. The honest position is that you are choosing which risk you would rather run, and the worst choice is running the single-secret risk without having noticed that you chose it.
Sources
- United States v. Gary James Harmon, No. 1:21-cr-00433 (BAH) (D.D.C.). Government’s Memorandum in Aid of Sentencing, ECF 56, filed 13 April 2023, 32 pages. Judgment, ECF 59, entered 27 April 2023. Docket
- United States v. Larry Dean Harmon, No. 1:19-cr-00395 (BAH) (D.D.C.). Indictment returned 3 December 2019. Plea agreement, ECF 122, 18 August 2021. Judgment, ECF 156, entered 15 November 2024. Docket
- Testimony of IRS Special Agent Jeremiah Haynie, detention hearing, N.D. Ohio, 11 February 2020, transcript at 37:13-38:8 and 65:21-23, as quoted in the sentencing memorandum above.
- Order Setting Conditions of Release, United States v. Larry Dean Harmon, ECF 20.
- Declaration in Support of Government’s Motion for Emergency Status Hearing, United States v. Larry Dean Harmon, ECF 22-1, 26 April 2020.
- FinCEN, In the Matter of Larry Dean Harmon d/b/a Helix, Assessment of Civil Money Penalty No. 2020-2, $60,000,000, signed by Director Kenneth A. Blanco. Assessment and Statement of Facts, 20pp
Disclosure. Max Avery is affiliated with Digital Ascension Group (DAG). Investment advisory services are offered through DAG Wealth, an SEC-registered investment adviser (CRD No. 328627). Registration does not imply a certain level of skill or training. DAG is not a law firm and does not provide legal or tax advice. Custody arrangements with third-party independent qualified custodians reduce certain risks but do not eliminate them. Nothing here is investment, legal, or tax advice, or a recommendation to buy or sell any asset. This article describes matters of public record; charges are allegations and defendants are presumed innocent unless and until proven guilty.