GoKawiilTreasury sanctions eight Tren de Aragua members over ATM jackpotting scheme
The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua for running ATM jackpotting attacks that drained millions of dollars from machines across the United States using malware such as Ploutus. The group is led by Anibal Alexander Canelon Aguirre, alias 'Prometheus,' an FBI Ten Most Wanted fugitive accused of developing the Ploutus malware, alongside six named associates. OFAC also blacklisted seven TRON cryptocurrency addresses linked to roughly $6.1 million in stolen funds.
GoKawiil's interpretation of the reporting above, not reported fact.
The sanctions reflect a broader U.S. government effort, described by OFAC as part of over 30 actions against more than 300 individuals and entities since 2025, targeting transnational criminal organizations. By designating crypto addresses alongside individuals, authorities appear to be trying to choke off the laundering pathways that let cash from physical ATM thefts move internationally. The case also underscores how gangs now blend old-school hardware exploitation with malware and crypto laundering to monetize financial crime at scale.
- Eight Tren de Aragua members, including fugitive 'Prometheus,' were sanctioned for ATM jackpotting attacks.
- The scheme used malware like Ploutus to force ATMs to dispense cash, then laundered proceeds internationally.
- Treasury also sanctioned seven TRON addresses tied to about $6.1 million in stolen funds.
Source: bleepingcomputer.com, 2026-10-02
Published there as: “US sanctions Tren de Aragua gang members in ATM hacks crackdown”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.