The U.S. Treasury has imposed sanctions on a criminal network tied to Tren de Aragua for allegedly conducting ATM jackpotting attacks that caused over $40.7 million in losses in more than 1,500 incidents as of August 2025. The operation allegedly used malware to force ATMs to dispense cash without customer interaction by installing malicious software and activating it remotely.
To disrupt the scheme’s financial pathways, Treasury’s Office of Foreign Assets Control (OFAC) added seven TRON crypto addresses linked to designated individuals to its Specially Designated Nationals (SDN) list. These addresses were reportedly used to move around $6.1 million since March 2022, though investigators caution not all of that amount is definitively tied to the jackpotting operations.
The Accused Actors & Structure
Central to the sanctions is Anibal Alexander Canelon Aguirre, referred to as “Prometheus,” a key figure accused of creating the malware used in the ATM heists. He is listed among the FBI’s Ten Most Wanted. Six others—Eric Gabriel Cardenas Arzola; Jose Dario Galeano Bazurto; Anthony Wuiliam Hernandez Guerrero; Carlos Javier Martinez Armenta; Oscar Leonardo Martinez Pirona; and Alejandro Mejia Castillo—are also sanctioned and tied to specific TRON deposit addresses. An eighth individual, Aslhy Javier Galeano Basurto, is included in related charges.
Charges against these individuals include providing material support for Tren de Aragua, conspiring in bank fraud, burglary of banks, and money laundering. Two companies, Enigma Community S. de R.L. de C.V. and Soluciones Integrales Toluca, S.A. de C.V., both tied respectively to Martinez Pirona and Mejia Castillo, were also sanctioned, along with a separate figure, Juan Gabriel Rivas Nunez, known as “Juancho,” for unrelated criminal gold mining offenses.
Money Trails & Crypto Involvement
Analysis shows that all seven designated TRON addresses are hosted on a centralized crypto exchange. Some were inactive for months, with the most recent incoming transfer traced to July 2026. The address attributed to Cardenas Arzola reportedly collected roughly $2.1 million—making it the single largest deposit among the flagged addresses.
Beyond direct deposits, investigators believe the network moved approximately $35 million through secondary channels tied to a larger money laundering web associated with Jorge Figueira, an individual under scrutiny for allegedly laundering about $1 billion.
OFAC’s sanctions prohibit U.S. persons or entities from conducting business with the designated individuals and companies, block any U.S.-held property, and carry reporting obligations. Financial firms and exchanges are urged to screen for the listed TRON addresses, review historical transaction records, and watch for indirect exposures via counterparties.
Also released were indicators of compromise (IoCs), including specific TRON deposit addresses associated with each individual. These identifiers are critical for threat detection systems, compliance operations, and law enforcement tracking.
This action follows a broader wave of crackdown on ATM jackpotting. Since late October 2025, nearly 100 individuals have been indicted in related schemes that blend physical bank facility intrusions with malware-driven theft. Tren de Aragua is alleged to be deeply entwined in many of these networks.
Why this matters:Jackpotting remains a potent threat combining physical and cyber attack vectors to drain ATMs, especially where systems are vulnerable to remote malware installation. Mobilizing cryptocurrency obscures financial trails and complicates detection. The Treasury’s move is a signal to exchanges and financial institutions to heighten compliance—and to lawmakers that even small-scale cash extraction operations can represent massive cross-border money laundering risks. Looking ahead, watch for hardened defenses in ATM hardware and OS software, increased regulatory scrutiny over crypto exchanges hosting suspicious addresses, and more cooperation between cybersecurity researchers, law enforcement, and financial regulators globally.
