The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) said on Sept. 30 that it had sanctioned 10 targets tied to an ATM cash-out network operated by Tren de Aragua, a Venezuelan gang, and separately designated one senior gang leader. Treasury said the network used malware to make ATMs in the United States dispense cash automatically, then laundered the proceeds through cryptocurrency transactions.
Prometheus named as alleged ringleader, seven people listed with TRON addresses
Treasury said the ATM theft network was led by Anibal Alexander Canelon Aguirre, known as 「Prometheus」, who it described as being on the FBI’s Ten Most Wanted list. He was accused of being the engineer behind the malware used in the ATM attacks. Treasury said the network was based in Mexico and Venezuela and targeted ATMs in the United States.
The 10 sanctioned targets include Prometheus and seven associates, all of whom have been indicted in federal district court in Nebraska, as well as two Mexico-based companies owned by two of those associates. OFAC on the same day also sanctioned Juan Gabriel Rivas Nunez, a senior Tren de Aragua figure whom Treasury said directed gold mining and drug exports across several South American countries.
According to the OFAC sanctions list, Prometheus and six other associates were each listed with a TRON wallet address. Treasury said Prometheus and several members of the network used cryptocurrency transactions to launder proceeds from the ATM thefts.
Once listed, any property or interests in property of the sanctioned parties in the United States, or held by U.S. persons, are blocked. U.S. persons are generally prohibited from dealing with them.
More than 1,500 suspected ATM jackpotting attacks reported
The technique is known as jackpotting. Treasury described it as a method in which criminals pry open an ATM, install malware, and then remotely send commands that bypass security controls and force the machine to keep dispensing cash until it is empty or the attack is interrupted. No customer account is debited during the process.
Treasury said that as of August 2025, suspected ATM jackpotting losses reported in the United States totaled $40.73 million across more than 1,500 attacks. The stolen cash was moved among gang members to obscure its origin, and one of the methods used was cryptocurrency transactions.
Justice Department has charged 98 people
Treasury said the U.S. Justice Department has charged 98 people in ATM jackpotting cases since Oct. 21, 2025. The charges include providing material support to a terrorist organization, bank theft, money laundering, and unauthorized computer intrusion. If convicted, defendants could face prison terms ranging from 20 years to 335 years.
The U.S. State Department designated Tren de Aragua as a foreign terrorist organization in February 2025.
Treasury Secretary Bessent said: 「The Trump administration will not allow terrorist organizations like Tren de Aragua to exploit the U.S. financial system or profit from theft and other criminal activity targeting U.S. individuals and businesses.」
