US Treasury Sanctions Tren de Aragua Gang for ATM Jackpotting Operations
The U.S. Treasury Department has sanctioned eight members of the Venezuelan criminal organization Tren de Aragua (TdA) for their involvement in ATM jackpotting attacks that stole millions of dollars from financial institutions across the United States. The sanctions were announced on October 2, 2026, targeting individuals who deployed malware on automated teller machines to force cash dispense and erase transaction evidence.
Key Individuals Sanctioned in ATM Hacking Scheme
The designated individuals include Anibal Alexander Canelon Aguirre, known as "Prometheus," and six associates: Eric Gabriel Cardenas Arzola, Jose Dario Galeano Bazurto, Anthony Wuiliam Hernandez Guerrero, Carlos Javier Martinez Armenta, Oscar Leonardo Martinez Pirona, and Alejandro Mejia Castillo. Aguirre is alleged to have developed the Ploutus malware used in these attacks and has been on the FBI's Ten Most Wanted Fugitives list since March 2026.
How ATM Jackpotting Attacks Work
In jackpotting attacks, criminals install malware such as ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus on bank and credit union ATMs. This malware allows attackers to command the machines to dispense cash reserves. Access is typically gained through a USB keyboard connected to the ATM or via the built-in PIN pad, enabling thieves to empty the machines and delete forensic logs.
Financial Impact and Law Enforcement Response
According to the Office of Foreign Assets Control (OFAC), Tren de Aragua gang members have stolen approximately $40.73 million from U.S. financial institutions through over 1,500 alleged ATM jackpotting attacks as of August 2025. Since October 2025, the U.S. Justice Department has charged 98 suspects linked to TdA in ATM jackpotting schemes, with potential prison sentences ranging from 20 to 335 years per individual.
"While Prometheus's network is based in Mexico and Venezuela, the scheme targets U.S.-based automated teller machines (ATMs), where criminals deploy malicious software (malware) to force ATMs to dispense cash. The stolen funds are then laundered and transferred to TdA members in various countries,"
Additional Sanctions Target Cryptocurrency Laundering
As part of the same action, the Treasury Department added seven TRON blockchain addresses to its Specially Designated Nationals and Blocked Persons (SDN) List. These addresses have received approximately $6.1 million in total inflows since March 2022 and were used to send funds to other Tren de Aragua-associated accounts, highlighting the gang’s use of cryptocurrency for money laundering.
Broader Government Campaign Against Transnational Crime
The sanctions are part of a sustained, whole-of-government initiative that has led to over 30 actions against more than 300 individuals and entities tied to transnational criminal organizations since 2025. The Treasury designated Tren de Aragua as a Transnational Criminal Organization in July 2024, and the Department of State labeled it a Foreign Terrorist Organization in February 2025.
Recent Developments in ATM Jackpotting Cases
Following a series of arrests targeting Tren de Aragua members, the FBI warned in February 2026 that criminals had stolen over $20 million in 2025 during a surge in ATM hacking incidents. Most recently, in early September 2026, five Venezuelan nationals pleaded guilty in U.S. federal court after failing to install malware in ATM jackpotting attempts in Wamego and Manhattan, Kansas.
Source: BleepingComputer