US Sanctions Tren de Aragua Network Over ATM Cash Thefts

The Treasury Department on Sept. 30 sanctioned 10 people and companies tied to Tren de Aragua, saying a crew built around ATM thefts had become a funding stream for the group. The department said the network is run by Anibal Alexander Canelon Aguirre, known as Prometheus, a fugitive on the FBI's Ten Most Wanted list.

The method is called jackpotting. Crews break into bank machines, install malware, then trigger it remotely so the machine dispenses cash without debiting any account. Treasury described a cycle of scouting target machines, gaining physical access, planting the software and sending a dispense command that empties the machine until it runs dry or the operation is stopped.

The scale is large. Reported losses from alleged jackpotting attacks in the United States totaled $40.73 million across more than 1,500 attacks as of August 2025. Since October 2025 the Justice Department has indicted 98 people over the schemes, on charges that include material support to a designated foreign terrorist organization, bank burglary, money laundering, computer intrusion and bank fraud. Convictions carry maximum penalties of between 20 and 335 years in prison.

Digital assets enter the picture after the theft. Treasury said the stolen cash was passed among group members and associates to hide its origin, with cryptocurrency transactions among the laundering methods. The cash itself came out of the machines; the crypto trail begins when the crew moves and disguises the proceeds.

That trail runs largely on Tron. Seven of the named individuals carry Tron wallet addresses now on the sanctions list, one address per person, Scorechain reported in its breakdown of the designation. The firm measured about $6.08 million in combined throughput across the seven wallets over roughly 3,900 transactions, almost entirely in USDT on Tron.

There is nothing left to freeze. Every one of the seven addresses has been emptied, with a combined balance under $40, the analysts found. On-chain activity stretches from March 2022 to July 2026, and five of the seven wallets stopped moving funds during 2025, which means any serious lookback has to cover years rather than months.

Prometheus sits at the center of the case. Treasury called him the alleged engineer of the jackpotting malware and said he has been photographed posing with crime proceeds. Six associates charged alongside him in federal court in Nebraska face allegations of material support, bank fraud conspiracy, bank burglary conspiracy and money laundering conspiracy: Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona and Anthony Wuiliam Hernandez Guerrero.

A second strand of the action targets gold. Juan Gabriel Rivas Nunez, known as Juancho, is described as a high-ranking Tren de Aragua leader directing gold mining, narcotics and violent crime across several South American countries. He was indicted in federal court in the Southern District of Texas in December 2025 for conspiring to support the group. Two Mexico-based firms were also designated: Enigma Community, linked to Martinez Pirona, and Soluciones Integrales Toluca, linked to Mejia Castillo.

The legal footing rests on two executive orders covering transnational crime and counterterrorism. All property of the designated people in the United States or in the hands of US persons is blocked, as are entities 50 percent or more owned by them. Foreign banks that handle significant transactions for the counterterrorism designees risk secondary sanctions, the Treasury notice states.

The action is part of a wider campaign. Treasury said more than 30 actions against over 300 people and entities tied to transnational criminal groups have been taken since 2025, coordinated with the FBI, Homeland Security Investigations, the financial crimes network FinCEN and Justice Department task forces. Earlier Tren de Aragua designations landed in June, July and December 2025, after the State Department named the group a foreign terrorist organization in February 2025.

Independent coverage matched the official account. The Crypto Times reported the same 10 targets and drew the same line between the physical thefts and the later laundering, noting the announcement treats crypto as one of several ways the crew moved the money rather than the tool used to rob the machines.

The designations took effect with their publication in the sanctions list update for Sept. 30, and screening systems have already flagged the seven Tron addresses as confirmed sanctions matches.