Harrisonburg Preschool CSAM Case: How a Crypto Trace Led to an Arrest
Key takeaways
- A cryptocurrency transaction from a US-based exchange account to a known CSAM vendor's address provided the initial investigative lead.
- Blockchain intelligence combined with traditional investigative work supported a search warrant that led to the alleged discovery of manufactured CSAM involving a preschool student.
- Coordinated work by the US Secret Service, Homeland Security Investigations, Harrisonburg Police, the Rockingham County Sheriff's Office, Child Protective Services, and the NOVA-DC ICAC Task Force moved the case from on-chain evidence to a search, device seizure, and arrest.
- The case shows blockchain intelligence driving a child protection lead, not just serving as a financial crime tool.
{{horizontal-line}}
A single crypto transaction as the starting point
A single cryptocurrency transaction — traced from a US-based exchange account to a known child sexual abuse material (CSAM) vendor's address — served as the starting point for an investigation that ended in the arrest of a Virginia preschool teacher on four felony charges.
On March 31, 2026, the Harrisonburg Police Department (HPD) arrested Zachery Harger after a coordinated investigation by the US Secret Service (USSS), Homeland Security Investigations (HSI), the Rockingham County Sheriff's Office (RCSO), Child Protective Services (CPS), and the Northern Virginia / DC Internet Crimes Against Children (ICAC) Task Force. Harger is alleged to have purchased CSAM and to have manufactured CSAM involving one of his preschool students. He is presumed innocent unless and until proven guilty in court.
The case is a clear example of blockchain intelligence functioning as a child protection tool — not solely as a financial crime tool.
What happened
According to HPD and local reporting
On February 23, 2026 — Crypto lead. The US Secret Service notified HPD and HSI about a cryptocurrency account allegedly used to purchase child pornography. USSS traced the transaction to a known CSAM vendor's address, worked with a cooperating US-based exchange to identify the account holder, and named Zachery Harger as the subject. Local prosecutors and the NOVA-DC ICAC Task Force then verified subject details and built a safe search and arrest plan.
March 13, 2026 — Search warrant and forensic review. HPD and the Rockingham County Sheriff's Office executed a search warrant at Harger's home. HPD digital forensic examiners reportedly found pornographic images of a young child on Harger's cellphone, which investigators believe were taken in the bathroom of the preschool where he worked. The child was identified as one of Harger's students. HPD's Victim Services Liaison Unit and CPS coordinated notification of the family.
March 31, 2026 — Arrest and charges. HPD arrested Harger and charged him with four felonies: three counts of manufacturing child pornography, allegedly committed between August 20, 2025 and November 25, 2025, and one count of unlawful filming. HPD has noted ongoing cooperation with Harrisonburg City Public Schools, USSS, HSI, RCSO, CPS, and the NOVA-DC ICAC Task Force.
Blockchain intelligence as a child protection lead
This case is not about recovering stolen funds or tracing sanctions evasion. On-chain intelligence directly supported child protection. The cryptocurrency account allegedly used to purchase CSAM was the triggering lead — combined with existing investigative work, it helped justify a search warrant. That warrant, and the forensic review that followed, led to the alleged discovery of manufactured CSAM tied to a preschool environment.
The takeaway for investigators: crypto evidence should not sit only in financial crime silos. In CSAM cases, on-chain leads can function as early-warning signals about people with access to children. In Harrisonburg, that lead was the difference between a tip on paper and evidence on a seized device.
"Harrisonburg is a powerful example of what happens when agencies treat blockchain intelligence as a core investigative tool. The US Secret Service, HSI, and local partners took on-chain activity, turned it into a warrant, and got to evidence that might otherwise have stayed hidden. That's exactly the kind of work we want to enable across law enforcement." — Kyle Armstrong, Director of Law Enforcement Relations, TRM Labs
A repeatable model for crypto-enabled CSAM investigations
The Harrisonburg case fits a broader pattern in CSAM investigations where cryptocurrency is the payment rail. Investigators can begin with a financial trace, work back from known seller infrastructure or payment patterns, and use that trail to support lawful process — including search warrants, device seizures, and arrests. In Harrisonburg, that model played out in a preschool context: on-chain activity helped support a warrant that led to the alleged discovery of manufactured CSAM and an arrest.
"When most people think about following the money in crypto, they think of fraud, narcotics, sanctions evasion, or scams. Harrisonburg shows something else — blockchain intelligence helping support a warrant that led to an arrest in a child exploitation case. Blockchain intelligence does not just recover funds. It helps law enforcement identify and pursue dangerous offenders." — Ali Comolli, Global Capacity Building Lead, TRM Labs
Credit to law enforcement and partners
This outcome reflects coordinated work by the US Secret Service, Homeland Security Investigations, the Harrisonburg Police Department, the Rockingham County Sheriff's Office, Child Protective Services, HPD's Victim Services team, and the NOVA-DC ICAC Task Force.
Training: TRM Academy CSAM Investigations Sprint, Chicago
To help agencies operationalize on-chain methods in child exploitation cases, TRM Academy will host a Minuteman CSAM Investigations Sprint in Chicago on June 3–4, 2026. The sprint focuses on using blockchain intelligence, OSINT, and digital forensics to identify offenders, support warrants, and protect victims in crypto-enabled CSAM cases. Eligible ICAC investigators and other law enforcement personnel can register here.
For agencies looking to replicate the Harrisonburg model, the sequence is straightforward: start with the chain, build probable cause, execute lawful process, protect the child.
{{horizontal-line}}
Frequently asked questions (FAQs)
1. What role did blockchain intelligence play in the Harrisonburg case?
A trace of a single cryptocurrency transaction from a US-based exchange account to a known CSAM vendor's address served as the initial lead. The US Secret Service identified the account holder by working with the exchange, then referred the case to Harrisonburg Police and HSI. The on-chain evidence helped support a search warrant that led to the alleged discovery of manufactured CSAM on the suspect's cellphone.
2. What charges does Zachery Harger face?
HPD charged Harger with four felonies: three counts of manufacturing child pornography, allegedly committed between August 20, 2025 and November 25, 2025, and one count of unlawful filming. Harger is presumed innocent unless and until proven guilty in court.
3. Which agencies were involved in the investigation?
The investigation involved the US Secret Service, Homeland Security Investigations, the Harrisonburg Police Department, the Rockingham County Sheriff's Office, Child Protective Services, HPD's Victim Services Liaison Unit, and the Northern Virginia / DC Internet Crimes Against Children (ICAC) Task Force. HPD has also noted ongoing cooperation with Harrisonburg City Public Schools.
4. Why is this case significant beyond financial crime?
Most discussions of "following the money" in crypto focus on fraud, narcotics, sanctions evasion, or scams. The Harrisonburg case shows on-chain leads functioning as a child protection signal — identifying a suspect with direct access to children and supporting the warrant that led to evidence of alleged manufacturing. It is a use case for blockchain intelligence that sits outside the traditional financial crime frame.
5. How can law enforcement agencies build this capability?
TRM Academy will host a Minuteman CSAM Investigations Sprint in Chicago on June 3–4, 2026, focused on using blockchain intelligence, OSINT, and digital forensics to identify offenders, support warrants, and protect victims in crypto-enabled CSAM cases. Eligible ICAC investigators and other law enforcement personnel can register here.
