An international criminal investigation has exposed a sophisticated financial network linking one of the FBI’s Ten Most Wanted Fugitives to the transnational criminal organization Tren de Aragua (TdA). According to federal authorities and blockchain intelligence, the network allegedly utilized cryptocurrency transactions to launder millions of dollars stolen from automated teller machines across the United States.
On September 30, 2026, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) took direct action by designating 10 primary targets tied to the criminal financing scheme. This regulatory enforcement exposed a complex financial apparatus that converted cash pilfered during physical ATM assaults into digital assets, facilitating the cross-border movement of funds to support TdA, which was officially designated as a Foreign Terrorist Organization (FTO) by the U.S. State Department in February 2025.
At the epicenter of the alleged conspiracy is Anibal Alexander Canelon Aguirre, an FBI fugitive widely known by the alias "Prometheus." Aguirre is currently wanted on federal charges that include bank fraud, burglary, money laundering, and providing material support to terrorists. Federal investigators assert that Aguirre engineered the specialized malware used to orchestrate physical attacks on U.S. banking infrastructure, after which he and his co-conspirators funneled the ill-gotten gains through digital currency channels.
As part of its enforcement measures, OFAC designated seven specific cryptocurrency addresses tied directly to Aguirre and six of his primary associates. These targeted assets consist of deposit addresses hosted at a major cryptocurrency exchange. Blockchain analytics firm Chainalysis has been actively tracing the on-chain footprint of Aguirre, his network, and the broader transnational group, uncovering deep ties to established international laundering syndicates.
How Tren de Aragua Targeted ATMs to Steal Millions
The financial campaign relied on a high-tech form of cybercrime commonly referred to as "jackpotting." In a typical jackpotting operation, malicious actors compromise automated teller machines by installing unauthorized malware designed to override internal security protocols, forcing the machine to physically dispense massive amounts of cash without debiting any customer account.
According to OFAC findings and a federal indictment unsealed in December 2025 by the U.S. Attorney’s Office for the District of Nebraska, Aguirre led a coordinated conspiracy that deployed specialized criminal crews from operational bases in Mexico and Venezuela directly into the United States. The attackers utilized the Ploutus malware strain, introducing it into targeted banking hardware via unconventional tools, including Raspberry Pi microcomputers.
The mechanics of the operation required precise physical and technical coordination. Operating crews would physically breach the housing of a targeted ATM, extract its internal hard drive, install the Ploutus software, and reinsert the modified drive. To evade forensic detection and law enforcement intervention, the malware was intentionally programmed with an advanced self-delete function that wiped all operational traces immediately after the cash was successfully dispensed.
Federal court documents detail how the criminal enterprise operated through compartmentalized teams. One crew was tasked with conducting reconnaissance, photographing prospective ATM targets, and checking for silent hood alarms. A secondary technical team handled the physical breach and malware installation, while a third group collected the physical currency from the compromised machines.
The financial toll of these operations has been substantial. By August 2025, cumulative reported losses stemming from the nationwide ATM jackpotting campaign had surpassed $40.73 million, distributed across more than 1,500 individual attacks on financial institutions throughout the United States.
Inside Tren de Aragua’s Crypto Money Laundering Networks
The operational blueprint utilized by Aguirre and his network highlights a concerning trend tracked closely by blockchain investigators: the increasing reliance by separate criminal enterprises on shared, centralized money laundering infrastructure. While illicit groups may source their revenue through disparate criminal activities ranging from drug trafficking to cyberattacks, they frequently converge on the same digital rails to convert physical cash into mobile, borderless cryptocurrency.
A detailed forensic analysis of the wallets associated with the TdA financial network revealed that their primary counterparties maintained direct exposure to major, pre-existing laundering operations. These included financial conduits previously leveraged by Colombian and Mexican drug cartels, as well as a separate network managed by a Venezuelan national who was previously charged with laundering approximately one billion dollars in illicit funds.
According to investigators, the digital footprint exposed by blockchain ledgers demonstrates how decentralized technologies are co-opted by traditional transnational syndicates. Stablecoins played a particularly central role in the operation, allowing the criminal network to export and store the proceeds of their U.S. thefts while insulating themselves against the volatility of traditional cryptocurrency markets.
However, the transparent nature of public ledgers also provided law enforcement and analytics firms with the visibility needed to track the funds. Real-time transaction monitoring allows compliance teams and issuing entities to freeze suspicious assets rapidly. In connection with the illicit network uncovered in this case, stablecoin issuer Tether had previously frozen USDT balances across multiple wallets that shared transactional exposure with the addresses formally sanctioned by OFAC.
Associates of Prometheus Laundered Theft Through Crypto
Alongside the designation of Aguirre, OFAC formally sanctioned six of his closest associates identified as key components of the financial network. The newly designated individuals include Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, and Anthony Wuiliam Hernandez Guerrero.
These individuals allegedly managed various logistical and financial aspects of the operation, ensuring that the proceeds generated from the American ATM jackpotting campaign were successfully introduced into the digital asset ecosystem and routed to the leadership of Tren de Aragua.
OFAC’s Expanding Campaign Against Tren de Aragua Financing
The September 30 sanctions represent the latest phase in an aggressive, sustained U.S. government campaign aimed at dismantling the financial architecture of Tren de Aragua. Since the State Department’s formal classification of TdA as an FTO in early 2025, OFAC has executed multiple waves of targeted designations against individuals and front organizations supporting the group.
Across the broader federal landscape, the administration has initiated more than 30 distinct enforcement actions targeting over 300 individuals and entities connected to transnational cartels and criminal syndicates since 2025. As these organizations continue to incorporate digital assets into their illicit financial operations—a shift documented extensively across Latin American markets—compliance professionals and regulatory bodies face heightened pressure to monitor on-chain movements closely.
Crypto Wallets & Security
Crypto Wallets & Security
Crypto Wallets & Security
