U.S. Treasury Sanctions Tren de Aragua Members Over $40 Million ATM Jackpotting Scheme

The U.S. Treasury Department has sanctioned eight members of Venezuela-based criminal organization Tren de Aragua (TdA) for allegedly stealing millions of dollars from U.S. banks and credit unions through ATM jackpotting attacks.

ATM jackpotting attacks use malware to force automated teller machines (ATMs) to dispense cash. Criminals can then use an attached USB keyboard or the ATM’s built-in PIN pad to control the machine, empty its cash reserves and remove evidence of the attack.

Tren de Aragua members accused of ATM jackpotting

The Treasury’s designation includes Anibal Alexander Canelon Aguirre, also known as “Prometheus,” and several associates, including Eric Gabriel Cárdenas Arzola, José Dario Galeano Bazurto, Anthony William Hernandez Guerrero, Carlos Javier Martinez Armenta, Oscar Leonardo Martinez Pirona and Alejandro Mejia Castillo.

Aguirre is credited with developing the Ploutus malware used to compromise ATMs. He has also been placed on the FBI’s Ten Most Wanted Fugitives list.

According to the U.S. Treasury’s Office of Foreign Assets Control (OFAC):

“Although the Prometheus network is based in Mexico and Venezuela, the scheme targets automated teller machines (ATMs) based in the United States, where the criminals deploy malicious software (malware) to force the ATMs to withdraw cash. The stolen funds are then laundered and transferred to TdA members in each country.”

OFAC said the sanctions are part of a broader campaign that has resulted in more than 30 actions against over 300 individuals and entities linked to transnational criminal organizations since 2025.

The Treasury Department designated Tren de Aragua as a transnational criminal organization in July 2024. In February 2025, the U.S. State Department designated the group as a foreign terrorist organization.

Sanctions include cryptocurrency addresses

According to the TRM Labs Institute, the Treasury also added seven TRON cryptocurrency addresses to the Specially Designated Nationals and Blocked Persons List.

The addresses reportedly received approximately $6.1 million in total inflows since March 2022 and transferred funds to other addresses associated with Tren de Aragua.

More than 1,500 alleged ATM attacks

OFAC estimates that, as of August 2025, Tren de Aragua members had stolen approximately $40.73 million from U.S. financial institutions in more than 1,500 alleged ATM jackpotting attacks.

Since October 2025, the U.S. Department of Justice has indicted 98 suspects associated with the gang and the ATM jackpotting scheme. The suspects face potential maximum sentences ranging from 20 to 335 years in prison.

After a series of arrests targeting members of the Venezuelan criminal organization, the FBI warned in February that ATM hacking cases were surging. The agency expected criminals to steal more than $20 million through the attacks by 2025.

Most recently, in early September, five Venezuelan nationals pleaded guilty to installing malware during ATM jackpotting attacks in Wamego and Manhattan, Kansas.

Join Mikko Hypponen and security leaders from the NFL, Chanel and Atlassian for a two-hour digital summit covering AI-speed attacks, outdated defensive practices and how security teams can verify, decide, fix and revalidate at machine speed.

Reserve your seat