The US Treasury’s Office of Foreign Assets Control (OFAC) sanctioned 10 targets on Wednesday. They are tied to an ATM jackpotting scheme run by Tren de Aragua (TdA).
The network allegedly washed the stolen cash through cryptocurrency, among other channels. The action also listed 7 crypto addresses belonging to ringleader “Prometheus,” an FBI Most Wanted fugitive, and his associates.
Inside Tren de Aragua’s Alleged ATM Jackpotting Playbook
TdA originated in Venezuela, and the State Department designated it a Foreign Terrorist Organization in February 2025. According to Treasury, ATM fraud has since become a key revenue source for the group.
Jackpotting attacks use malware to make ATMs release cash without debiting any account. Court filings in Nebraska name the strain as Ploutus, which was set to erase itself after each attack.
Treasury identifies Prometheus as Anibal Alexander Canelon Aguirre, the alleged engineer of that malware. He sits on the FBI’s Ten Most Wanted Fugitives list and faces charges in Nebraska federal court.
Treasury said reported US losses from alleged jackpotting attacks reached $40.73 million as of August 2025. That total spans more than 1,500 incidents.
OFAC separately sanctioned Juan Gabriel Rivas Nunez, a senior TdA leader linked to illicit gold mining.
How the Sanctioned Wallets Tie Into Wider Laundering Networks
TRM Labs says each of the 7 addresses is a deposit account held at a centralized exchange. They took in about $6.1 million since March 2022, though TRM notes not all of it necessarily ties to jackpotting.
The addresses also sent funds to other TdA-linked wallets. Those wallets, in turn, moved roughly $35 million to a network US authorities link to Jorge Figueira. Figueira, a Venezuelan national, faces charges of laundering about $1 billion and has not been convicted.
Separately, Chainalysis found the wallets’ counterparties had exposure to a laundering network used by Colombian and Mexican cartels. Chainalysis Senior Intelligence Analyst Kaitlin Martin described the pattern.
“The on-chain insights show us that criminal organizations are leveraging common infrastructure for laundering,” Martin said.
Chainalysis added that these networks rely heavily on stablecoins. Tether had previously frozen Tether (USDT) balances on several wallets exposed to the newly sanctioned addresses.
Because OFAC used Executive Order (E.O.) 13224, foreign financial institutions knowingly handling significant transactions for designees risk secondary sanctions. Meanwhile, TRM said the exchange hosting all 7 addresses may be able to identify the account holders behind them.
Subscribe to our YouTube channel to watch leaders and journalists provide expert insights
