The United States Department of the Treasury’s Office of Foreign Assets Control (OFAC) has executed a decisive strike against the financial infrastructure of the transnational criminal organization Tren de Aragua (TdA), designating ten key individuals involved in a sophisticated ATM "jackpotting" and cryptocurrency laundering ring. At the center of this investigation is Anibal Alexander Canelon Aguirre, known by the alias "Prometheus," a high-profile operative who recently ascended to the FBI’s Ten Most Wanted Fugitives list. Aguirre is accused of engineering a complex malware scheme that siphoned tens of millions of dollars from American financial institutions to fund the operations of TdA, which the U.S. government officially designated as a Foreign Terrorist Organization (FTO) in early 2025.
The September 30, 2026, sanctions represent a milestone in the federal government’s efforts to dismantle the nexus between physical bank robberies and digital asset exploitation. By blacklisting seven specific cryptocurrency addresses tied to Aguirre and his associates—primarily deposit addresses at a major global exchange—authorities have signaled a new era of "on-chain" enforcement. This action follows a massive investigation involving the FBI, the Treasury, and private-sector blockchain analytics firms, which successfully traced the movement of stolen cash as it was converted into stablecoins and transferred across international borders.
The Rise of Tren de Aragua and the "Prometheus" Connection
Tren de Aragua originated as a prison gang in the Aragua state of Venezuela but has since evolved into a hyper-violent transnational syndicate with a footprint spanning South America, Central America, and the United States. While the group initially gained notoriety for human trafficking, extortion, and drug smuggling, its expansion into high-tech financial crime represents a significant shift in its operational capabilities.
Anibal Alexander Canelon Aguirre, the alleged mastermind behind the group’s technical division, earned his "Prometheus" moniker for his ability to "bring fire" to the financial sector through malware. Aguirre is currently wanted by federal authorities for bank fraud, burglary, money laundering, and providing material support to a terrorist organization. His expertise allowed TdA to move beyond street-level crime into the realm of "jackpotting"—a method of ATM exploitation that treats bank machines like slot machines, forcing them to dispense their entire cash reserves on command.
According to federal indictments, Aguirre did not act alone. OFAC has designated six of his primary associates: Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, and Anthony Wuiliam Hernandez Guerrero. These individuals allegedly formed the backbone of a "crew" system that deployed from bases in Mexico and Venezuela to strike targets across the United States.
Anatomy of the Attack: The Ploutus Malware and Raspberry Pi Deployment
The technical sophistication of the TdA scheme relied on a specific strain of malware known as "Ploutus." While jackpotting has existed for years, Aguirre’s team refined the process into a clinical, multi-stage operation. The group utilized Raspberry Pi devices—small, inexpensive, single-board computers—to interface directly with the internal hardware of automated teller machines.
The operational chronology of a typical TdA jackpotting attack followed a strict protocol:
- Reconnaissance: A specialized "scout" crew would photograph targeted ATMs, checking for physical vulnerabilities and the presence of silent "hood alarms" that trigger when the machine’s casing is opened.
- Installation: A secondary team would physically breach the ATM, often using specialized keys or tools to gain access to the top compartment. They would temporarily remove the ATM’s hard drive, infect it with the Ploutus malware via the Raspberry Pi, and reinsert the drive.
- Execution and Collection: Once the malware was active, the attackers could command the machine to dispense all available cash without needing a debit card or an authorized transaction.
- Forensic Sanitization: A critical feature of the Ploutus strain used by Aguirre was its "self-delete" function. After the cash was successfully dispensed, the malware would erase its own code and logs, leaving investigators with little to no digital evidence of how the breach occurred.
By August 2025, the scale of these attacks had reached a crisis point. Reported losses from jackpotting incidents linked to this specific network totaled $40.73 million, spanning more than 1,500 individual attacks on financial institutions across the continental United States.
From Cash to Crypto: The Laundering Infrastructure
The most challenging aspect of the TdA operation was the conversion of millions of dollars in physical cash into a portable, digital format that could be sent back to the organization’s leadership in Venezuela. To achieve this, the group utilized a "shared laundering infrastructure"—a network of crypto-brokers and "mules" that service multiple criminal enterprises simultaneously.
Blockchain analysis conducted by Chainalysis revealed that the wallets used by Aguirre and his associates were not isolated. Instead, they were deeply integrated into a broader ecosystem of illicit finance. Investigators found significant "on-chain" exposure to money laundering operations based in Mexico and Colombia, some of which are also utilized by major drug cartels. One notable counterparty in the network was linked to a Venezuelan national previously charged with laundering over $1 billion in illicit funds.
Stablecoins, particularly USDT (Tether), played a central role in this process. Because stablecoins maintain a 1:1 peg with the U.S. dollar, they provided TdA with the price stability necessary for large-scale value transfer without the volatility of assets like Bitcoin. However, the use of stablecoins also proved to be the group’s undoing. Because these assets operate on public blockchains, investigators could monitor the flow of funds in real-time. This visibility allowed the stablecoin issuer, Tether, to proactively freeze several million dollars in USDT across wallets linked to the sanctioned addresses before the funds could be withdrawn.
Chronology of the Federal Crackdown
The dismantling of the TdA financial network is the result of a multi-year effort by the U.S. government to address the growing threat of transnational gangs.
- February 2025: The U.S. State Department officially designates Tren de Aragua as a Foreign Terrorist Organization, citing its role in destabilizing regional security and its involvement in human smuggling.
- August 2025: A comprehensive report by the Department of Justice identifies a surge in ATM jackpotting, estimating losses at over $40 million and establishing the first concrete links to TdA-affiliated crews.
- December 2025: A federal grand jury returns a major indictment against Aguirre and his six primary associates, detailing the use of Ploutus malware and the Raspberry Pi deployment method.
- May 2026: Investigative leads from the TdA case contribute to over 30 separate actions against 300 entities tied to transnational crime, including the Sinaloa Cartel.
- September 30, 2026: OFAC issues the formal designation of the 10 targets and blacklists their cryptocurrency addresses, effectively cutting them off from the legitimate global financial system.
Official Responses and Strategic Implications
The designation has drawn praise from law enforcement and intelligence analysts who view it as a necessary evolution in the fight against high-tech crime. Senior Intelligence Analyst Kaitlin Martin noted that the transparency of the blockchain is providing insights that were previously impossible to obtain in the era of purely cash-based money laundering. "The on-chain insights show us that criminal organizations are leveraging common infrastructure for laundering," Martin stated. "These are insights that only the blockchain can provide."
The U.S. Treasury Department emphasized that this action is part of a "sustained campaign" against the financial lifeblood of TdA. By targeting the crypto-wallets, the government aims to create a "chokepoint" that prevents the organization from reinvesting its stolen profits into further criminal activities, such as weapons procurement or human trafficking.
For the cryptocurrency industry, this case serves as a stark reminder of the increasing relevance of OFAC designations. Compliance teams at major exchanges are now expected to utilize advanced monitoring tools to identify and block transactions that even tangentially touch sanctioned addresses. The speed with which Tether was able to freeze assets in this case suggests a growing level of cooperation between private-sector asset issuers and federal law enforcement.
Broader Impact on the Financial Sector
The TdA jackpotting scheme has forced a reckoning within the banking industry regarding ATM security. The transition from simple physical theft to sophisticated malware-driven exploitation means that traditional security measures, such as armored casings and cameras, are no longer sufficient. Banks are now being urged to implement end-to-end encryption between the ATM’s internal computer and its cash-dispensing peripheral, as well as more robust physical protections for the machine’s internal hardware ports.
Furthermore, the case highlights the "Latin Americanization" of crypto-crime. While much of the global focus on crypto-laundering has historically centered on Eastern European or East Asian actors, the TdA investigation proves that South American syndicates are rapidly closing the technical gap. As these groups continue to route illicit funds through digital assets, the intersection of traditional street crime and high-tech financial fraud will likely remain a primary focus for international law enforcement for years to come.
As of today, Anibal Alexander Canelon Aguirre remains at large. The FBI continues to offer a significant reward for information leading to his capture, warning that he should be considered armed and extremely dangerous. The blacklisting of his financial assets, however, has significantly hampered his ability to operate, turning the very technology he used to steal millions into the primary tool for his eventual downfall.
