US Sanctions Tren de Aragua ATM Network as Suspect Pleads Not Guilty

Treasury sanctioned a Tren de Aragua ATM-jackpotting network tied to $40.73 million; alleged Ploutus developer Anibal Canelon Aguirre pleaded not guilty.

The U.S. Treasury’s OFAC on September 30 sanctioned a Tren de Aragua-linked network accused of malware-driven ATM jackpotting, designating eight individuals—including alleged Ploutus developer Anibal Alexander Canelon Aguirre, also known as Prometheus and The Engineer—two Mexico-based companies, and seven TRON addresses under Executive Orders 13581 and 13224. Treasury estimates the network stole $40.73 million across more than 1,500 U.S. attacks as of August 2025; TRM Labs said the seven addresses received about $6.1 million since March 2022 but cautioned that not all of it is confirmed jackpotting proceeds. The 50-year-old Venezuelan, on the FBI Ten Most Wanted list since March 2026 and described by one outlet as the first cybercriminal placed there, appeared in Nebraska federal court on October 2, 2026, pleaded not guilty, and remains detained on conspiracy charges including bank fraud, money laundering, bank burglary, computer fraud, and material support to terrorists, facing up to 70 years if convicted. Prosecutors allege his group hit at least 63 bank ATMs and 54 credit-union ATMs from February 2024 through December 2025, taking more than $5.4 million, often over $100,000 an incident, with another $1,429,738 attempted—figures distinct from the $40.73 million network estimate and from an FBI statement that ATM hacking stole more than $20 million in 2025. Sources disagree on the broader case count: reports through October 5 say the Justice Department charged 98 people since October 21, 2025, while October 6 reports say 120 defendants have been charged and three sentenced, and one account says Aguirre was indicted in December 2025 with 21 others. Defendants remain presumed innocent; outlets also reported a separate illicit-gold-mining designee, said Tren de Aragua was designated a transnational criminal organization and later a foreign terrorist organization, and alleged that proceeds supported the group’s operations, with attacks linked to 47 states, D.C., and other countries.

• On September 30, OFAC designated eight people—including alleged Ploutus developer Anibal Alexander Canelon Aguirre (Prometheus/The Engineer)—two Mexico-based companies, and seven TRON addresses under Executive Orders 13581 and 13224.
• Treasury estimates the network stole $40.73 million in more than 1,500 U.S. ATM jackpotting attacks as of August 2025.
• TRM Labs said the seven TRON addresses received about $6.1 million since March 2022, but not all of that value is confirmed jackpotting proceeds.
• Aguirre, 50, a Venezuelan on the FBI Ten Most Wanted list since March 2026, pleaded not guilty in Nebraska federal court on October 2, 2026, remains detained, and faces up to 70 years if convicted on conspiracy charges including bank…
• Prosecutors allege his group hit at least 63 bank ATMs and 54 credit-union ATMs from February 2024 through December 2025, taking more than $5.4 million, often over $100,000 per incident, with another $1,429,738 attempted.
• Wider totals conflict: an FBI statement says ATM hacking stole more than $20 million in 2025, and attacks were linked to 47 states, D.C., and other countries.
• Charging counts disagree: reports through October 5 say 98 people were charged since October 21, 2025, while October 6 reports say 120 defendants have been charged and three sentenced; one account says he was indicted in December 2025 with…
• One later outlet, without naming him or Ploutus, called the suspect the first cybercriminal on the FBI most-wanted list and said jackpotting cash allegedly supported Tren de Aragua’s violent operations; allegations remain unproven.