---
title: "US Sanctions Tren de Aragua Network for $40.7M ATM Jackpotting Scheme"
description: "OFAC designated 10 individuals and seven crypto addresses tied to FBI fugitive Anibal Aguirre, who allegedly used stablecoins to launder stolen cash."
url: https://basisdesk.news/news/ofac-sanctions-tren-de-aragua-atm-crypto-laundering
published: 2026-09-30T20:11:04.903Z
modified: 2026-09-30T20:11:04.903Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: neutral
tickers: [USDT]
tags: [OFAC, Tren de Aragua, Sanctions, ATM Jackpotting, Chainalysis, Tether, USDT]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# US Sanctions Tren de Aragua Network for $40.7M ATM Jackpotting Scheme

OFAC designated 10 individuals and seven crypto addresses tied to FBI fugitive Anibal Aguirre, who allegedly used stablecoins to launder stolen cash.

## Key points

- OFAC designated 10 individuals and seven crypto exchange deposit addresses tied to a $40.73 million ATM jackpotting ring run by Tren de Aragua.
- Alleged ringleader Anibal Alexander Canelon Aguirre ("Prometheus") is an FBI Top Ten fugitive who engineered the Ploutus ATM malware.
- Chainalysis found the group used shared laundering infrastructure and stablecoins; Tether previously froze USDT on exposed wallets.

## Editorial remark

- **Context:** The State Department designated Tren de Aragua as a Foreign Terrorist Organization in February 2025, triggering over 30 federal actions against more than 300 affiliated targets as US authorities target their diversified revenue streams.
- **Impact:** Centralized exchanges must blacklist the seven designated deposit addresses, while the case underscores how stablecoin issuers coordinate with intelligence firms to freeze illicit proceeds before official sanctions roll out.
- **Watch:** Compliance teams will watch for further secondary wallet blacklistings tied to the Venezuelan, Colombian, and Mexican laundering networks that serviced the syndicate.

The US Department of the Treasury's Office of Foreign Assets Control (OFAC) designated 10 individuals on Sept. 30 connected to an automated teller machine (ATM) "jackpotting" operation run by the transnational criminal organization Tren de Aragua [1]. The network allegedly stole at least $40.73 million from US financial institutions and moved the illicit proceeds across borders using cryptocurrency [1].

At the center of the sanctions action is Anibal Alexander Canelon Aguirre, known by the alias "Prometheus," who is listed among the FBI's Ten Most Wanted Fugitives [1]. According to a December 2025 indictment, Aguirre engineered the Ploutus malware strain and directed crews who breached ATMs with Raspberry Pi units to force cash dispensations [1]. Losses from the group's jackpotting attacks exceeded $40.73 million across more than 1,500 incidents as of August 2025 [1]. OFAC also sanctioned six alleged associates alongside Aguirre: Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, and Anthony Wuiliam Hernandez Guerrero [1].

## On-Chain Laundering and Stablecoin Freezes

OFAC's enforcement action designated seven specific cryptocurrency addresses held at a major exchange that belong to Aguirre and his co-conspirators [1]. On-chain intelligence firm Chainalysis reported that counterparties to these wallets interacted with shared money laundering operations across Mexico, Colombia, and Venezuela [1]. These networks were also utilized by regional drug cartels and a Venezuelan national accused of laundering $1 billion [1].

Chainalysis noted that the syndicate relied heavily on stablecoins, including $USDT, to transfer cash internationally [1]. Tether had previously frozen USDT balances across multiple wallets exposed to the newly designated addresses prior to the Treasury action [1]. The enforcement follows a broader US campaign targeting Tren de Aragua, which the State Department designated as a Foreign Terrorist Organization in February 2025 [1]. At the time of writing, USDT traded at $0.9995 amid wider market capitalization of $2.83 trillion.

## FAQ

**What is ATM jackpotting?**

Jackpotting is a cyberattack where perpetrators physically compromise an automated teller machine to install malware, commanding the hardware to dispense cash without debiting any user accounts.

**Why were cryptocurrency addresses included in the OFAC sanctions?**

OFAC designated seven deposit addresses at a major exchange that were directly controlled by fugitive Anibal Aguirre and his associates to convert physical cash stolen from ATMs into digital assets.

## Sources

1. [OFAC Sanctions Tren de Aragua Fugitive Who Laundered ATM Heists With Crypto](https://www.chainalysis.com/blog/ofac-sanctions-tren-de-aragua-crypto-laundering-september-2026/) — Chainalysis Blog, 2026-09-30

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai