A high-ranking transnational criminal enterprise funneling illicit cash through the digital asset ecosystem has faced a sweeping crackdown by United States regulatory and law enforcement authorities. On September 30, 2026, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced the designation of ten targets tied to a sophisticated financial network. This network allegedly laundered millions of dollars stolen from automated teller machines across the United States to finance the operations of Tren de Aragua (TdA), a violent transnational criminal organization officially designated as a Foreign Terrorist Organization (FTO) by the U.S. State Department in February 2025.
At the center of the targeted network is Anibal Alexander Canelon Aguirre, widely known by his alias "Prometheus," who currently holds a place on the FBI’s Ten Most Wanted Fugitives list. According to federal investigators, Aguirre engineered the specialized cyberattack mechanisms used to hollow out financial institution reserves and subsequently orchestrated the cryptocurrency transactions required to launder the stolen funds across international borders. Alongside Aguirre, OFAC designated six close associates: Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, and Anthony Wuiliam Hernandez Guerrero.
Blockchain intelligence and investigative firm Chainalysis has been actively tracing the on-chain footprint of Aguirre, his associates, and the broader TdA syndicate. As part of its enforcement action, OFAC specifically targeted seven cryptocurrency deposit addresses at a major exchange controlled by Aguirre and members of his conspiracy. These designations highlight a growing intersection between physical cybercrimes against traditional banking infrastructure and the illicit use of digital assets for cross-border money laundering.
How Tren de Aragua Targeted ATMs to Steal Millions
The financial pipeline supporting Tren de Aragua relied heavily on a specialized cyberattack methodology known within the cybersecurity and law enforcement communities as "jackpotting." This sophisticated form of attack involves criminals gaining physical access to automated teller machines, installing malicious software directly onto the machine’s internal hardware, and executing commands that force the hardware to dispense massive quantities of physical cash without debiting any customer or bank account.
Federal indictments unsealed in December 2025 detail how Aguirre and his co-conspirators executed these operations across the United States. The criminal network deployed specialized tactical crews originating from operational bases in Mexico and Venezuela. These operatives utilized the Ploutus malware strain, introducing the malicious code onto targeted ATMs by physically breaking into the housing units, removing the internal hard drives, installing the software via micro-computers such as Raspberry Pis, and reinserting the modified drives.
To evade law enforcement detection and forensic analysis, the Ploutus malware was intentionally programmed with a self-delete function designed to wipe all operational traces immediately after the cash was dispensed. The conspiracy operated with a high degree of division of labor. Specialized teams were assigned to distinct phases of each operation: initial reconnaissance crews photographed target ATMs and checked for silent alarms, technical operators installed the malware, and separate collection crews gathered the physical currency.
Data compiled by federal investigators indicates that the scale of the conspiracy was massive. By August 2025, cumulative reported losses from these targeted ATM jackpotting campaigns surpassed $40.73 million, resulting from more than 1,500 distinct attacks across the United States. The proceeds from these widespread burglaries and bank frauds provided a steady stream of liquid capital to fuel the broader illegal activities of Tren de Aragua throughout the Western Hemisphere.
Inside Tren de Aragua’s Crypto Money Laundering Networks
While the initial phase of the criminal enterprise involved physical cash theft from traditional banking terminals, converting and moving those millions of dollars internationally required sophisticated laundering infrastructure. Aguirre and his network turned to digital assets, utilizing cryptocurrency rails to obscure the trail and export their illicit proceeds across borders.
Investigators analyzing the blockchain architecture surrounding the sanctioned TdA wallets uncovered deep operational ties to broader, established criminal money laundering networks. Counterparties interacting with the TdA-linked addresses showed direct exposure to major laundering operations previously utilized by international drug trafficking cartels in Colombia and Mexico, as well as a massive laundering apparatus managed by a Venezuelan national recently charged with moving approximately one billion dollars in illicit funds.
On-chain analysis reveals that transnational criminal organizations increasingly rely on shared, centralized laundering infrastructure. While individual syndicates may source their illicit proceeds through entirely different criminal enterprises—ranging from drug smuggling and human trafficking to cyber-enabled bank fraud—they frequently funnel those funds through the same intermediary networks and digital asset service providers to clean the money.
Furthermore, the investigative findings demonstrate that these illicit networks heavily favor stablecoins to move funds internationally. Stablecoins offer criminal organizations price stability while circumventing traditional foreign exchange controls, but this reliance also exposes them to advanced blockchain monitoring and swift law enforcement intervention. Real-time monitoring techniques deployed by blockchain analytics firms and digital asset issuers have proven effective at disrupting these flows. Notably, stablecoin issuer Tether previously froze USDT balances across multiple wallets that shared direct exposure to the very addresses targeted in the recent OFAC sanctions.
OFAC’s Expanding Campaign Against Tren de Aragua Financing
The September 30 sanctions represent a continuation of a sustained, multi-agency U.S. government campaign aimed at dismantling the financial architecture of Tren de Aragua. Since the State Department’s designation of TdA as an FTO in early 2025, OFAC has executed multiple rounds of targeted sanctions against its leadership, financial facilitators, and front companies.
Broader federal enforcement efforts since 2025 have resulted in over 30 distinct administrative actions targeting more than 300 individuals and entities connected to various transnational criminal organizations. As criminal syndicates increasingly route their illicit proceeds through the digital asset ecosystem—a development documented across Latin American markets by compliance researchers—regulatory agencies and blockchain intelligence firms emphasize that compliance teams must remain vigilant regarding on-chain risk indicators and sanctions enforcement.
FAQs
What is ATM jackpotting?
ATM jackpotting is a cyberattack where criminals compromise automated teller machines by installing malicious software directly onto the hardware. This malware forces the machine to dispense physical cash on command without debiting any customer or bank account. Attackers typically gain physical access to the interior of the machine, modify the internal hard drive, and remotely trigger the cash-dispensing mechanism.
Who is Prometheus, the FBI’s Most Wanted fugitive linked to ATM jackpotting?
Prometheus is the alias of Anibal Alexander Canelon Aguirre, who is listed among the FBI’s Ten Most Wanted Fugitives. Federal authorities allege that he engineered the Ploutus malware used in the ATM jackpotting schemes and led a transnational conspiracy responsible for stealing millions of dollars from U.S. financial institutions to support Tren de Aragua. He was officially designated by OFAC on September 30, 2026.
What is Tren de Aragua?
Tren de Aragua (TdA) is a violent transnational criminal organization that originated in Venezuela and has since expanded its operations across the Western Hemisphere. The U.S. State Department designated TdA as a Foreign Terrorist Organization in February 2025 due to its involvement in drug trafficking, human trafficking, extortion, and systemic financial crimes such as ATM jackpotting.
How did Tren de Aragua use cryptocurrency to launder ATM jackpotting proceeds?
According to U.S. Treasury findings, the TdA network used cryptocurrency transactions to launder cash stolen during ATM jackpotting raids and transfer the funds across international borders. Blockchain investigations revealed that the network’s wallets interacted with counterparties linked to major drug cartel laundering operations in Mexico, Colombia, and Venezuela, relying heavily on stablecoins to move capital globally.
What is Ploutus malware?
Ploutus is a specialized malware strain designed to compromise automated teller machines and force unauthorized cash dispensations. In the TdA conspiracy, attackers deployed Ploutus by using Raspberry Pi devices after physically removing an ATM’s hard drive to install the code. The software was engineered with an automated self-delete function designed to erase all operational traces after an attack to thwart forensic investigations.
How much money was stolen in ATM jackpotting attacks linked to Tren de Aragua?
Federal investigations and court filings established that as of August 2025, reported financial losses resulting from the targeted ATM jackpotting attacks in the United States totaled approximately $40.73 million across more than 1,500 individual incidents.
What cryptocurrency addresses were sanctioned in the TdA designation?
As part of the September 30, 2026 enforcement action, OFAC designated seven specific cryptocurrency addresses belonging to Aguirre and his associates. These addresses functioned as deposit accounts at a major digital asset exchange. Prior to the formal sanctions, stablecoin issuer Tether had already frozen USDT balances on wallets exhibiting direct transactional exposure to these addresses.
What laundering networks did Tren de Aragua use?
Chainalysis investigators discovered that counterparties interacting with the TdA-linked cryptocurrency wallets maintained direct exposure to established money laundering operations utilized by Colombian and Mexican drug cartels, as well as a Venezuelan national facing federal charges for laundering approximately one billion dollars in illicit funds. The network shared common infrastructure with multiple Latin American criminal enterprises to convert stolen fiat currency into digital assets.
Crypto Wallets & Security
Crypto Wallets & Security
Crypto Wallets & Security
