The U.S. Treasury Department has imposed sanctions on eight individuals identified as members of the Venezuelan criminal organization Tren de Aragua (TdA) for their alleged involvement in ATM jackpotting schemes across the United States. These attacks, which utilize malware to force ATMs to dispense cash, have reportedly resulted in the theft of millions of dollars.
The sanctioned individuals include Anibal Alexander Canelon Aguirre, known by the alias "Prometheus," who has been on the FBI's Ten Most Wanted Fugitives list since March. Aguirre is accused of developing the Ploutus malware, a tool commonly used in these ATM hacks. The other six associates named in the sanctions are Eric Gabriel Cardenas Arzola, Jose Dario Galeano Bazurto, Anthony Wuiliam Hernandez Guerrero, Carlos Javier Martinez Armenta, Oscar Leonardo Martinez Pirona, and Alejandro Mejia Castillo.
According to the Office of Foreign Assets Control (OFAC), Aguirre's network operates primarily from Mexico and Venezuela, but its targets are U.S.-based ATMs. The stolen funds are then allegedly laundered and transferred to other TdA members internationally. This action is part of a broader government initiative that has seen over 30 enforcement actions against more than 300 individuals and entities linked to transnational criminal organizations since 2025.
The Treasury Department designated TdA as a Transnational Criminal Organization in July 2024, and the Department of State followed suit in February 2025 by designating it a Foreign Terrorist Organization.
In addition to the individual sanctions, the Treasury Department has added seven TRON cryptocurrency addresses to its Specially Designated Nationals and Blocked Persons List (SDN List). These addresses have reportedly received approximately $6.1 million in total inflows since March 2022 and have sent funds to other addresses associated with TdA.
OFAC estimates that TdA gang members have stolen an estimated $40.73 million from U.S. financial institutions through over 1,500 alleged ATM jackpotting attacks as of August 2025. Since October 2025, the U.S. Justice Department has charged 98 suspects linked to TdA and these jackpotting schemes, with potential prison sentences ranging from 20 to 335 years.
Earlier in 2025, the FBI issued a warning in February about a significant increase in ATM hacking incidents, reporting that over $20 million had been stolen that year alone. This warning followed a series of arrests targeting TdA members. More recently, in early September, five Venezuelan nationals pleaded guilty to charges related to unsuccessful attempts to install malware in ATMs in Wamego and Manhattan, Kansas.
