A Denver Mint employee stole roughly $100,000 in gold between 1919 and 1920 by carrying out one small bar a day in a hollow compartment cut into his prosthetic leg. Guards never searched it. He buried all of it in his garden and never spent a dollar.

[u/unteachablecourses]

Orville Harrington worked at the United States Mint in Denver — a granite fortress on West Colfax with its own armed police force and vaults built to hold a national reserve. He had a prosthetic lower leg from an old injury, and a limp everyone who worked there had stopped noticing.

Cut into the calf section was a slot roughly nine inches long and half an inch wide, covered with a thin flap of leather. It held exactly one three-inch gold anode — the spent slab left over from electrolytic refining.

Every working day for most of a year he took one, walked past the guards, nodded, and went home.

The control that didn't exist

The guards were competent. The vaults held. The locks held. Nothing in the physical security stack failed.

What Harrington had identified is that the only container in the building nobody could search was attached to his body. Inspecting it meant asking a visibly disabled colleague to remove his leg at the door, daily, on suspicion of nothing. The social cost of that control exceeded its expected value, so the control was never implemented.

That's the useful way to read it, I think. Not "they were sloppy" but "there was a gap in coverage whose existence was determined by social policy rather than by threat modelling, and one person noticed."

Rate-limiting below the detection threshold

The other half was discipline. No vault raid, no sack of bullion. One anode. Every day. For months.

A single anode disappears into the ordinary churn of an industrial refining operation — waste, weighing error, process loss. It generates no event. No alarm, no witness, no incident to investigate. He deliberately kept every individual action inside the noise floor, and let the aggregate accumulate into something like a hundred thousand dollars at 1920 prices while earning four dollars a day.

The temptation that catches most insiders is to increase the rate once the method proves out. He never did. He drew his anode like a salary.

What actually detected it

Not security. Accounting.

Gold is mass, and mass gets weighed. However slowly you drain a refinery, at the end of the period the metal that went in has to reconcile against the metal that came out, minus known losses. Harrington's theft was invisible as an event and fully visible as arithmetic. Eventually the books didn't balance, and the unaccounted metal was too large to write off as process loss.

Note the sequence, because it's the characteristic signature: the Mint knew it was being robbed well before it knew who was robbing it. Detection came from a downstream reconciliation control. Attribution came separately and much later.

And once they were certain gold was leaving a sealed building nobody had broken into, the conclusion was forced. The suspect pool was the payroll.

Perimeter to person

A Secret Service agent named Goddard closed it by doing the unglamorous thing — narrowing to employees with refinery access, then following one home and watching him.

What he observed was a quiet, respectable man burying gold in his own garden. Confronted, Harrington unbuckled the leg, set it on the table, and pulled back the leather to show the slot. Asked where the gold was, he said: the garden, and the basement.

The case was broken entirely outside the building. The only place an insider's activity is visible is the gap between what he earns and what he has.

The constraint that actually beat him

Here's the part that I think is genuinely interesting for this sub, because it inverts the usual lesson.

Gold is the most fungible asset there is. No serial numbers, no registry, no provenance a buyer can check. It melts. Compared to a stolen painting or a marked banknote, it's about as anonymous as stolen property gets.

He still couldn't touch it, because he wasn't anonymous. A Mint employee on four dollars a day who starts spending like a wealthy man is advertising. Every channel that converts illicit value into usable wealth would have surfaced the mismatch.

So he buried it. He built a perfect intake and no outflow at all, and every additional day of successful theft just increased the size of the evidence pile in his yard.

The anonymity of the asset doesn't matter if the holder is identifiable. That generalises reasonably well — a lot of exfiltration is technically successful and practically worthless because monetisation requires becoming visible.

His explanation from jail was that four dollars a day wasn't enough to enjoy life on. Which is the whole insider profile in one sentence: legitimate access, a durable sense of grievance, and no plan past acquisition.

It keeps happening at the cash-out

In 2015 a refiner at the Royal Canadian Mint moved roughly $130,000 in gold out past the metal detectors, often working alone and out of camera range. He wasn't caught at the door. He was caught when a bank teller found his deposits suspicious.

In 2026 a former intelligence officer with high-level clearance was charged after agents reportedly seized something like $40 million in gold bars from his home — allegations still to be tested, but structurally the same shape with three more orders of magnitude.

Full write-up on the leg, the investigation, the 1922 armed robbery two years later, and the insider-threat lineage:

https://unteachablecourses.com/denver-mint-man-with-golden-leg/

The question I keep circling: the control that caught Harrington was mass balance. Gold decrements when you remove it, so reconciliation eventually surfaces the aggregate no matter how far below the event threshold each individual action sits.

Data doesn't decrement when you copy it. There is no mass balance. The single most effective detection control in this case has no direct analogue in information exfiltration, which is why volumetric DLP and UEBA baselines are trying to reconstruct a signal that physical inventory gets for free.

So — for people doing this work now — is there anything that actually substitutes for reconciliation? Canary documents and access-pattern entropy are the closest I can think of, and both feel like weaker proxies than "the gold that went in didn't come out." Or is the honest position that for digital assets, detection has largely conceded the aggregate and moved to behavioural anomaly plus catching it at monetisation, the way both Mint cases actually resolved?