U.S. DOJ Seizes Over $400 Million in Assets Linked to Helix Crypto Mixing Service

Riza Dagoc

2 min read

U.S. DOJ Seizes Over $400 Million in Assets Linked to Helix Crypto Mixing Service

The U.S. Department of Justice (DOJ) has taken legal ownership of more than $400 million worth of seized cryptocurrency, real estate, and cash connected to Helix, a once-prominent darknet bitcoin mixing service. The a…

By Riza Dagoc

Published Jan 30, 2026, 8:38 PM EST

Mentioned assets

BTC Bitcoin

U.S. DOJ Seizes Over $400 Million in Assets Linked to Helix Crypto Mixing Service. Source: Markus Spiske/UnsplashCybersecurity firm Trend Micro has identified a previously unknown malware strain named Phemedrone Stealer. This malware exploits a now-patched security flaw in Microsoft Windows, explicitly targeting web browsers and extracting data from crypto wallets. The Texas-based firm's report reveals that Phemedrone Stealer is not limited to crypto-related information; it also harvests data from messaging apps such as Telegram, Steam, and Discord. Beyond Data Theft Cybersecurity experts have noted that Phemedrone Stealer goes beyond traditional data theft methods. According to Crypto News, in addition to extracting sensitive information, the malware captures screenshots and collects comprehensive system details, including hardware specifications, location data, and operating system information. This multifaceted approach underscores the sophistication of modern cyber threats as threat actors continually evolve their tactics. The stolen data is transmitted to the attackers through Telegram or a command-and-control (C&C) server. Trend Micro highlights that the vulnerability stems from the absence of checks on Microsoft Defender and related prompts on Internet Shortcut (.url) files. Threat actors exploit this loophole by creating .url files, initiating the download and execution of malicious scripts, and effectively bypassing Windows Defender SmartScreen warnings and checks. Despite the security patch released by Microsoft, Trend Micro warns that an increasing number of malware campaigns, including those distributing the Phemedrone Stealer payload, continue to exploit this security gap. The exact scale of stolen crypto or private data due to Phemedrone Stealer remains unclear. Cybersecurity Efforts Mitigate Financial Impact In 2023, the De.Fi REKT database recorded a concerning 455 incidents, with the largest hack amounting to $231 million, attributed to Multichain. According to Trend Micro, despite the alarming cumulative total of $2 billion, cybersecurity experts and white hat hackers managed to recover approximately $200 million from the overall sum. This indicates that while the cyber threat landscape is evolving, concerted efforts from cybersecurity professionals contribute significantly to mitigating the financial impact of malicious activities, offering a glimmer of resilience against cyber threats. Photo: Markus Spiske/Unsplash

The U.S. Department of Justice (DOJ) has taken legal ownership of more than $400 million worth of seized cryptocurrency, real estate, and cash connected to Helix, a once-prominent darknet bitcoin mixing service. The announcement underscores the U.S. government’s ongoing crackdown on illicit crypto activity, particularly services designed to conceal the origins of digital assets.

Helix was a bitcoin mixing service built to obscure transaction trails by pooling and redistributing funds, making it harder to trace the source and destination of cryptocurrency. While such services are sometimes marketed as privacy tools, U.S. law enforcement alleged that Helix was primarily used by drug traffickers and other criminals to launder illicit proceeds. According to court records, Helix was among the most widely used mixers on the darknet, especially by vendors operating on online drug marketplaces.

Investigators revealed that Helix processed at least 354,468 bitcoin, which was valued at approximately $300 million at the time of the transactions. A significant portion of these funds was tied to darknet drug markets. Authorities stated that Helix’s operator, Larry Dean Harmon, earned substantial commissions and fees by facilitating these transactions. Harmon also ran Grams, a darknet search engine that helped users locate major darknet markets, further strengthening Helix’s role in the underground economy.

Helix’s application programming interface (API) allowed darknet marketplaces to integrate the mixer directly into their bitcoin withdrawal systems. This technical integration enabled seamless laundering of funds, making Helix especially attractive to criminal networks seeking efficiency and anonymity in their crypto transactions.

Harmon pleaded guilty in August 2021 to conspiracy to commit money laundering. In November 2024, he was sentenced to 36 months in prison, followed by three years of supervised release. The sentence also included a forfeiture money judgment and the surrender of seized assets, which now fall under U.S. government ownership.

The DOJ noted that since 2020, its Criminal Division’s Computer Crime and Intellectual Property Section has secured more than 180 cybercrime convictions and court orders, resulting in the return of over $350 million to victims. The Helix case highlights increasing regulatory scrutiny of crypto mixing services and signals that law enforcement continues to target platforms linked to money laundering and darknet crime.

Riza Dagoc

Riza Dagoc reports on regulation, investing and the digital-asset business for TokenPost. Send corrections or tips to info@tokenpost.com.