US Treasury Targets Tren de Aragua’s Crypto Laundering Network Tied to ATM Heists

A sprawling crypto laundering operation tied to the violent Venezuelan gang Tren de Aragua has been exposed by the U.S. Treasury Department, which this week sanctioned ten individuals accused of helping launder tens of millions of dollars stolen from American ATMs using digital currency.

The Office of Foreign Assets Control (OFAC) announced the designations on September 30, naming a network accused of orchestrating a so-called “jackpotting” scheme that drained at least $40.73 million from U.S. financial institutions. According to Treasury officials, the stolen cash was funneled through cryptocurrency transactions designed to obscure its origin and move value across borders in support of Tren de Aragua, which the U.S. government has formally designated a Foreign Terrorist Organization.

A fugitive mastermind and his crypto laundering trail

At the center of the scheme is Anibal Alexander Canelon Aguirre, known by the alias “Prometheus,” who sits on the FBI’s Ten Most Wanted Fugitives list. Aguirre is accused of engineering the malware used to force ATMs to spit out cash on command, then relying on crypto laundering techniques to convert and move the proceeds without detection. He faces charges including bank fraud, burglary, money laundering, and providing material support to a terrorist organization.

Blockchain analytics firm Chainalysis, which traced the on-chain footprint of the operation, identified seven crypto addresses belonging to Aguirre and his associates that were sanctioned as part of the action. Those addresses functioned as deposit wallets at a major cryptocurrency exchange, giving investigators a window into how the stolen funds were processed and distributed through the network.

Six other individuals were named alongside Aguirre in the Treasury action: Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, and Anthony Wuiliam Hernandez Guerrero. Investigators say these associates played supporting roles in the broader financing scheme that bankrolled Tren de Aragua’s U.S. operations.

How the ATM “jackpotting” scheme worked

“Jackpotting” refers to a cyberattack technique in which criminals physically install malware on automated teller machines, tricking them into dispensing cash without ever debiting an account. According to a December 2025 indictment, Aguirre’s crews infected ATMs with a malware strain known as Ploutus, deploying it through small, inexpensive computers called Raspberry Pis that were connected directly to compromised machines.

Once the cash was physically retrieved, the group turned to cryptocurrency to clean the proceeds and move value across borders efficiently, a pattern increasingly common among transnational criminal organizations seeking to avoid the scrutiny that comes with bulk cash smuggling. Treasury officials say Aguirre directed crews dispatched into the United States from a logistics network based in Mexico and Venezuela, coordinating the thefts and the subsequent laundering remotely.

Crypto laundering links to broader criminal networks

Chainalysis investigators who mapped the wallets connected to the sanctioned individuals found that their counterparties had exposure to established money laundering infrastructure used by a range of illicit actors, including Colombian and Mexican criminal organizations and Venezuelan-based launderers. That overlap suggests the Tren de Aragua crypto laundering pipeline did not operate in isolation but instead tapped into shared financial plumbing already used for drug trafficking and smuggling proceeds.

The findings underscore a trend blockchain analysts have flagged repeatedly in recent years: digital assets have become a preferred tool for organized crime groups looking to move illicit proceeds quickly and across jurisdictions, even as law enforcement agencies get better at tracing those same transactions after the fact. Chainalysis has noted that sanctioned wallets, once flagged, effectively become radioactive to legitimate exchanges, cutting off access to much of the formal financial system.

For U.S. authorities, the designations represent both a disruption tactic and a warning shot to the broader Tren de Aragua network, which has expanded its footprint in American cities in recent years through extortion, trafficking, and now sophisticated bank fraud schemes. By sanctioning the crypto addresses directly, Treasury aims to choke off the financial rails the gang relies on, even as Aguirre himself remains at large.

Investigators say the case illustrates how deeply cryptocurrency has become embedded in the financing structures of organized crime, and how crypto laundering investigations now require piecing together cross-border networks spanning multiple countries and criminal enterprises rather than tracking a single bad actor.