OFAC Sanctions Tren de Aragua Network Tied to ATM Jackpotting and Crypto Laundering
Summary
OFAC sanctioned 10 people and entities tied to a Tren de Aragua scheme that allegedly used Ploutus malware to steal $40.73 million from U.S. ATMs and cryptocurrency to launder the proceeds.
Key points
- The September 30, 2026 action designated 10 targets, including seven cryptocurrency addresses linked to Anibal Alexander Canelon Aguirre and associates.
- Aguirre, also known as “Prometheus,” is accused of leading the scheme and engineering the Ploutus ATM malware.
- According to a 2025 indictment, crews physically accessed ATMs, installed Ploutus via Raspberry Pi devices, and divided tasks among scouting, installation, and cash collection teams.
- The malware reportedly erased traces after dispensing cash; alleged attacks caused $40.73 million in losses across more than 1,500 incidents as of August 2025.
- Chainalysis found the wallets’ counterparties had exposure to laundering operations in Mexico, Colombia, and Venezuela; the network used stablecoins to move proceeds.
- Tether had previously frozen USDT on wallets with exposure to the sanctioned addresses.
Article Details
- Event Type
- OFAC sanctions designation targeting a cryptocurrency-laundering network linked to ATM jackpotting for Tren de Aragua.
- Impact
- OFAC designated 10 targets on September 30, 2026, including seven cryptocurrency deposit addresses belonging to Anibal Alexander Canelon Aguirre and associates. Reported losses from alleged ATM jackpotting attacks in the United States totaled $40.73 million across more than 1,500 attacks as of August 2025. The proceeds were allegedly laundered through cryptocurrency to support Tren de Aragua; Tether had previously frozen USDT balances on wallets with exposure to the sanctioned addresses.
People
Alejandro Mejia CastilloOne of Aguirre’s six associates designated by OFAC and linked to the ATM jackpotting and laundering scheme.Anibal Alexander Canelon AguirreAlleged leader of the ATM jackpotting conspiracy; allegedly engineered the Ploutus malware and laundered stolen funds through cryptocurrency. The source says he is also known as “Prometheus.”Anthony Wuiliam Hernandez GuerreroOne of Aguirre’s six associates designated by OFAC and linked to the ATM jackpotting and laundering scheme.Carlos Javier Martinez ArmentaOne of Aguirre’s six associates designated by OFAC and linked to the ATM jackpotting and laundering scheme.Eric Gabriel Cardenas ArzolaOne of Aguirre’s six associates designated by OFAC and linked to the ATM jackpotting and laundering scheme.Jose Dario Galeano BazurtoOne of Aguirre’s six associates designated by OFAC and linked to the ATM jackpotting and laundering scheme.Kaitlin MartinChainalysis Senior Intelligence Analyst who commented on criminal organizations using common infrastructure for laundering.Oscar Leonardo Martinez PironaOne of Aguirre’s six associates designated by OFAC and linked to the ATM jackpotting and laundering scheme.
Threat Actors
Alejandro Mejia CastilloNamed associate designated by OFAC in connection with the ATM jackpotting and laundering scheme.Anibal Alexander Canelon AguirreAlleged leader of the ATM jackpotting and cryptocurrency-laundering conspiracy; the source identifies “Prometheus” as his alias.Anthony Wuiliam Hernandez GuerreroNamed associate designated by OFAC in connection with the ATM jackpotting and laundering scheme.Carlos Javier Martinez ArmentaNamed associate designated by OFAC in connection with the ATM jackpotting and laundering scheme.Eric Gabriel Cardenas ArzolaNamed associate designated by OFAC in connection with the ATM jackpotting and laundering scheme.Jose Dario Galeano BazurtoNamed associate designated by OFAC in connection with the ATM jackpotting and laundering scheme.Oscar Leonardo Martinez PironaNamed associate designated by OFAC in connection with the ATM jackpotting and laundering scheme.PrometheusAlias of Anibal Alexander Canelon Aguirre, whom the source identifies as the alleged leader of the ATM jackpotting and cryptocurrency-laundering conspiracy.Tren de AraguaTransnational criminal organization that the source says was supported by proceeds from the alleged ATM jackpotting and cryptocurrency-laundering scheme.
Malware
Vendors
Products
Raspberry Pistrain designed to force ATMs to dispense cash. In the TdA scheme, attackers deployed Ploutus via Raspberry Pi devices, physically removing an ATM’s hard drive to install the malware and reinserting it. TheUSDTmonitoring of networks like these allow for instant freezing actions. Indeed, Tether previously froze USDT balances on several wallets with exposure to the addresses sanctioned today.
Countries
Colombianetwork’s wallets had counterparties with exposure to major money laundering operations based in Mexico, Colombia, and Venezuela, and that the network relied heavily on stablecoins to move criminal proceeds.Mexicowallets. What we found: counterparties with exposure to known money laundering operations based in Mexico, Columbia, and Venezuela that have been used by a wide variety of illicit actors involved in drugUnited Stateswithout debiting any account. According to OFAC, Aguirre led a conspiracy that deployed crews to the United States from a network based in Mexico and Venezuela, stealing millions of dollars from financial institutionsVenezuelafound: counterparties with exposure to known money laundering operations based in Mexico, Columbia, and Venezuela that have been used by a wide variety of illicit actors involved in drug trafficking, smuggling, and