The United States Department of the Treasury’s Office of Foreign Assets Control (OFAC) has executed a major regulatory strike against the financial infrastructure of Tren de Aragua (TdA), a transnational criminal organization, by designating ten key individuals involved in a sophisticated ATM "jackpotting" and cryptocurrency laundering network. At the center of this enforcement action is Anibal Alexander Canelon Aguirre, a high-profile fugitive currently on the FBI’s Ten Most Wanted list. Aguirre, known in the criminal underworld by the alias “Prometheus,” is alleged to have engineered the technical malware used to siphon tens of millions of dollars from American financial institutions, subsequently funneling the proceeds through a complex web of digital asset wallets to support TdA’s global operations.
The designation, announced on September 30, 2026, marks a pivotal moment in the U.S. government’s ongoing campaign to dismantle the financial capabilities of TdA, which was officially designated as a Foreign Terrorist Organization (FTO) in February 2025. This latest action specifically targets seven cryptocurrency deposit addresses hosted at a major global exchange, which investigators have linked directly to Aguirre and six of his primary associates. According to blockchain analysis firm Chainalysis, these addresses served as critical nodes in a cross-border laundering operation that bridged the gap between physical cash theft in the United States and the illicit economies of Mexico, Colombia, and Venezuela.
The Mechanics of the Jackpotting Conspiracy
ATM jackpotting represents a high-tech evolution of traditional bank robbery. Rather than using explosives or heavy machinery to breach a safe, criminals use "logical" attacks to manipulate the machine’s internal software. According to the December 2025 indictment that preceded these sanctions, Aguirre’s network utilized a specific strain of malware known as "Ploutus."
The operational methodology was highly disciplined and divided into specialized crews. The process typically began with a reconnaissance team that would photograph target ATMs and monitor the premises for "silent hood alarms"—security features designed to alert banks when an ATM’s outer casing is opened. Once a target was deemed viable, an installation crew would physically break into the machine, remove the hard drive, and use a Raspberry Pi—a small, inexpensive computer—to infect the system with the Ploutus malware.
Once the infected drive was reinserted, the malware allowed the attackers to issue commands to the ATM’s dispensing peripheral, forcing it to empty its entire cash reserve without debiting any legitimate customer account. To frustrate forensic investigators, the Ploutus strain included a "self-delete" function that wiped the malware from the system after the cash was dispensed, leaving behind minimal digital footprints. A third "mule" crew was then responsible for collecting the physical cash and transporting it to laundering points. As of August 2025, federal reports indicated that this specific conspiracy was responsible for over 1,500 attacks across the United States, resulting in total losses exceeding $40.73 million.
From Stolen Cash to Digital Assets: The Laundering Pipeline
The transition from physical currency to the digital realm is where the TdA network sought to obscure the origin of its funds. Investigators found that Aguirre and his associates—including Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, and Anthony Wuiliam Hernandez Guerrero—leveraged shared laundering infrastructure.
By analyzing the on-chain footprint of the now-sanctioned wallets, Chainalysis investigators discovered that the TdA network was not operating in a vacuum. Their digital wallets showed significant exposure to established money laundering hubs in Latin America that service a variety of illicit actors, including major drug cartels in Colombia and Mexico. One particularly notable connection involved a Venezuelan national previously charged with laundering approximately $1 billion in illicit funds.
A defining characteristic of the TdA laundering strategy was the heavy reliance on stablecoins, specifically USDT (Tether). Stablecoins are preferred by criminal organizations because they offer the speed and borderless nature of cryptocurrency without the extreme price volatility associated with assets like Bitcoin. However, the use of centralized stablecoins also provides law enforcement and private sector partners with a mechanism for intervention. Prior to the OFAC announcement, Tether had already frozen several USDT balances associated with wallets that showed exposure to the Aguirre network, demonstrating an increasing level of cooperation between the crypto industry and federal authorities.
Profile of a Fugitive: Who is Prometheus?
Anibal Alexander Canelon Aguirre’s rise to the FBI’s Ten Most Wanted list highlights the growing intersection of cybercrime and traditional organized crime. Aguirre is not merely a financier; he is described by investigators as a master engineer who provided the technical "material support" necessary for TdA to expand its operations into the United States.
Aguirre’s charges include bank fraud, burglary, money laundering, and providing material support to a designated terrorist organization. His alias, "Prometheus," reflects his role as the individual who "brought the fire"—in this case, the technical capability—to the TdA organization. His ability to coordinate crews across Mexico, Venezuela, and the U.S. suggests a high level of organizational sophistication. Law enforcement officials believe that while Aguirre remains at large, the freezing of his digital assets and the public exposure of his associates will significantly hamper his ability to move freely or fund his continued evasion of justice.
Chronology of Enforcement Against Tren de Aragua
The crackdown on Aguirre’s jackpotting ring is the result of a multi-year effort to curb the expansion of Tren de Aragua. The organization, which originated in the Tocorón prison in Venezuela, has rapidly evolved from a local prison gang into a transnational powerhouse involved in human trafficking, narcotics, and high-stakes financial crime.
- February 2025: The U.S. State Department officially designates Tren de Aragua as a Foreign Terrorist Organization (FTO), citing its role in destabilizing the region and its involvement in violent crime across the Western Hemisphere.
- August 2025: Financial institutions and the Department of Justice report a massive surge in ATM jackpotting attacks, with losses crossing the $40 million mark.
- December 2025: A grand jury returns a multi-count indictment against Aguirre and his associates, detailing the use of Raspberry Pis and Ploutus malware in U.S.-based attacks.
- May 2026: Federal authorities link TdA’s financial operations to broader laundering networks used by the Sinaloa Cartel, showing a convergence of Latin American criminal enterprises.
- September 30, 2026: OFAC officially designates 10 individuals and seven cryptocurrency addresses, effectively cutting them off from the U.S. financial system and alerting global exchanges to freeze any associated assets.
Official Responses and Strategic Implications
The Treasury Department’s action has drawn significant attention from both the financial sector and geopolitical analysts. In a statement following the designations, Treasury officials emphasized that the move was part of a "sustained campaign" to degrade the financial foundations of transnational criminal organizations (TCOs). Since 2025, the U.S. administration has taken over 300 actions against individuals and entities tied to such groups.
"The on-chain insights provided by our investigators show us that criminal organizations are increasingly leveraging common infrastructure for laundering," stated Kaitlin Martin, a Senior Intelligence Analyst at Chainalysis. "These groups are moving away from isolated operations and are instead plugging into ‘laundering-as-a-service’ networks that provide them with the tools to convert stolen cash into stablecoins and move it across borders instantly. However, the transparency of the blockchain remains their greatest vulnerability."
The implications of this case extend beyond the recovery of stolen funds. The use of FTO designations for criminal gangs like Tren de Aragua signals a shift in U.S. policy, treating organized crime with the same level of urgency and resource allocation as traditional political terrorism. For financial institutions, the case underscores the need for enhanced monitoring of "low-tech" physical vulnerabilities, such as ATM security, which can serve as the primary source of funds for "high-tech" crypto-laundering schemes.
The Broader Impact on Latin American Markets
The TdA case is emblematic of a broader trend across Latin America, where criminal groups are increasingly integrating cryptocurrency into their business models. From the "crypto-remittances" used by cartels in Mexico to the illicit mining operations found in Venezuela, the digital asset ecosystem has become a frontier for both innovation and exploitation.
As compliance teams and investigators globally monitor the addresses associated with Aguirre and his six associates, the focus remains on the "choke points"—the major cryptocurrency exchanges where illicit funds are converted back into fiat currency or moved into the broader economy. The September 30 action serves as a warning to these platforms that they must maintain rigorous Know Your Customer (KYC) and Anti-Money Laundering (AML) protocols to avoid being used as a gateway for designated terrorist organizations.
While Anibal Alexander Canelon Aguirre remains a fugitive, the international community’s ability to map his financial network in real-time represents a significant evolution in law enforcement capabilities. The "Prometheus" case serves as a blueprint for future actions against TCOs, combining traditional boots-on-the-ground detective work with advanced blockchain forensics to strike at the heart of modern criminal finance.
