US Sanctions Tren de Aragua Network for $40.7M ATM Jackpotting Scheme
OFAC designated 10 individuals and seven crypto addresses tied to FBI fugitive Anibal Aguirre, who allegedly used stablecoins to launder stolen cash.
Key points
- OFAC designated 10 individuals and seven crypto exchange deposit addresses tied to a $40.73 million ATM jackpotting ring run by Tren de Aragua.
- Alleged ringleader Anibal Alexander Canelon Aguirre ("Prometheus") is an FBI Top Ten fugitive who engineered the Ploutus ATM malware.
- Chainalysis found the group used shared laundering infrastructure and stablecoins; Tether previously froze USDT on exposed wallets.
The US Department of the Treasury's Office of Foreign Assets Control (OFAC) designated 10 individuals on Sept. 30 connected to an automated teller machine (ATM) "jackpotting" operation run by the transnational criminal organization Tren de Aragua 1. The network allegedly stole at least $40.73 million from US financial institutions and moved the illicit proceeds across borders using cryptocurrency 1.
At the center of the sanctions action is Anibal Alexander Canelon Aguirre, known by the alias "Prometheus," who is listed among the FBI's Ten Most Wanted Fugitives 1. According to a December 2025 indictment, Aguirre engineered the Ploutus malware strain and directed crews who breached ATMs with Raspberry Pi units to force cash dispensations 1. Losses from the group's jackpotting attacks exceeded $40.73 million across more than 1,500 incidents as of August 2025 1. OFAC also sanctioned six alleged associates alongside Aguirre: Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, and Anthony Wuiliam Hernandez Guerrero 1.
On-Chain Laundering and Stablecoin Freezes
OFAC's enforcement action designated seven specific cryptocurrency addresses held at a major exchange that belong to Aguirre and his co-conspirators 1. On-chain intelligence firm Chainalysis reported that counterparties to these wallets interacted with shared money laundering operations across Mexico, Colombia, and Venezuela 1. These networks were also utilized by regional drug cartels and a Venezuelan national accused of laundering $1 billion 1.
Chainalysis noted that the syndicate relied heavily on stablecoins, including $USDT, to transfer cash internationally 1. Tether had previously frozen USDT balances across multiple wallets exposed to the newly designated addresses prior to the Treasury action 1. The enforcement follows a broader US campaign targeting Tren de Aragua, which the State Department designated as a Foreign Terrorist Organization in February 2025 1. At the time of writing, USDT traded at $0.9995 amid wider market capitalization of $2.83 trillion.
Questions this story raises
- What is ATM jackpotting?
- Jackpotting is a cyberattack where perpetrators physically compromise an automated teller machine to install malware, commanding the hardware to dispense cash without debiting any user accounts.
- Why were cryptocurrency addresses included in the OFAC sanctions?
- OFAC designated seven deposit addresses at a major exchange that were directly controlled by fugitive Anibal Aguirre and his associates to convert physical cash stolen from ATMs into digital assets.
Sources
- [1] OFAC Sanctions Tren de Aragua Fugitive Who Laundered ATM Heists With Crypto — Chainalysis Blog, September 30, 2026
Written by Basis Desk's newsroom system from the primary sources above and machine-verified against them before publication. Market figures marked "at the time of writing" come from live exchange data. Report an error: corrections@basisdesk.news · corrections policy.
Not financial advice. Basis Desk publishes information, not recommendations. Crypto assets are volatile and you can lose what you invest.