US Treasury Sanctions Crypto Wallets Linked to Tren de Aragua's ATM Jackpotting Scheme

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned 10 targets associated with an ATM jackpotting scheme linked to the Tren de Aragua (TdA) gang. This action, taken on September 30, 2026, includes seven cryptocurrency wallets belonging to Anibal Alexander Canelon Aguirre, also known as Prometheus, who is on the FBI's Ten Most Wanted Fugitives list.

Tren de Aragua, which originated in Venezuela and was designated a Foreign Terrorist Organization by the State Department in February 2025, has allegedly used malware to execute jackpotting attacks, resulting in significant financial losses. According to Treasury reports, these attacks have drained approximately $40.73 million from U.S. banks across more than 1,500 incidents.

The malware, identified as Ploutus, allows criminals to manipulate ATMs into dispensing cash without debiting any accounts. The Treasury's findings indicate that the sanctioned wallets have received around $6.1 million since March 2022, with some funds being transferred to other TdA-linked wallets.

Chainalysis has noted that these wallets are connected to broader laundering networks associated with Colombian and Mexican cartels, highlighting the use of stablecoins in these operations. Tether has previously frozen balances on wallets linked to the newly sanctioned addresses.

In addition to Aguirre, OFAC also sanctioned Juan Gabriel Rivas Nunez, a senior leader within TdA, who is linked to illicit gold mining activities. The Treasury has made it clear that it will not tolerate the exploitation of the U.S. financial system by terrorist organizations.