The U.S. Treasury’s Office of Foreign Assets Control (OFAC) sanctioned 10 people and entities on Tuesday, September 30, tied to Tren de Aragua (TdA), a Venezuela-based criminal organization designated as a foreign terrorist group, according to a Treasury announcement. The network used malware to force U.S. ATMs to dispense cash in “jackpotting” attacks, then laundered the proceeds through cryptocurrency, including Tron (TRX) wallet addresses now published on the sanctions list.
ATM jackpotting powered the scheme
The operation was orchestrated by Anibal Alexander Canelon Aguirre, known as “Prometheus,” an FBI Ten Most Wanted fugitive who investigators say engineered the jackpotting malware. The network targeted U.S.-based automated teller machines, installing malware that forced the machines to dispense cash without debiting an account. OFAC said reported losses from alleged ATM jackpotting attacks across the United States totaled $40.73 million across more than 1,500 attacks as of August 2025.
TdA, which the State Department designated a foreign terrorist organization in February 2025, has expanded from Venezuela across the Western Hemisphere through drug trafficking, human trafficking, extortion and money laundering.
Crypto laundering and Tron addresses on the SDN list
Among other methods, the network used cryptocurrency transactions to launder jackpotting proceeds, the Treasury said. The Specially Designated Nationals (SDN) update lists Tron digital currency addresses for seven of the designated individuals, including Prometheus and six associates indicted in the District of Nebraska on bank fraud, bank burglary and money-laundering conspiracy charges.
OFAC also designated two Mexican front companies owned by the suspects — Enigma Community and Soluciones Integrales Toluca — under the same executive orders, which block any U.S. property and generally prohibit U.S. persons from dealing with the listed parties.
Part of a wider enforcement push
“President Trump’s administration will not allow terrorist organizations like Tren de Aragua to exploit the U.S. financial system,” said Treasury Secretary Scott Bessent. Since October 2025, the Justice Department has indicted 98 people in the jackpotting investigation, which also touched TdA-linked gold mining and involved the FBI, HSI, FinCEN and DOJ’s Joint Task Force Vulcan.
The same order designated Juan Gabriel Rivas Nunez, a high-ranking TdA leader, over his role directing gold mining, narcotics export and violent crime across South America. It follows other Treasury crypto designations, including its sanctions on the Iranian crypto exchange BitBank and a separate cross-border crypto money-laundering sweep.
