The U.S. Treasury sanctioned ten people and businesses tied to an alleged Tren de Aragua ATM-theft network and added seven Tron addresses to its sanctions list. Chainalysis traced the wallets to a major exchange and found their counterparties had ties to cartel and Venezuelan laundering networks that relied heavily on stablecoins.
The U.S. Treasury's Office of Foreign Assets Control sanctioned 10 people and businesses tied to an alleged Tren de Aragua ATM-theft network on Sept. 30, 2026. Treasury said the network stole millions from U.S. financial institutions, citing reported U.S. ATM "jackpotting" losses of $40.73 million across more than 1,500 attacks as of August 2025.
OFAC's action added seven Tron addresses to its Specially Designated Nationals list. Chainalysis identified them as deposit addresses at a major crypto exchange and traced their counterparties' exposure to shared laundering networks.
A fugitive accused of engineering the malware
Among those sanctioned is Anibal Alexander Canelon Aguirre, known as "Prometheus," whom the FBI added to its Ten Most Wanted Fugitives list in March. Treasury alleges he engineered the malware used in the attacks and used cryptocurrency to launder the proceeds.
In jackpotting attacks, criminals physically access cash machines, install malware and activate it remotely to force cash withdrawals without debiting an account, Treasury said. The targeted network, based in Mexico and Venezuela, laundered the stolen funds and transferred them to TdA members in multiple countries, according to Treasury.
Treasury said the ATM-related designations cover eight individuals and two Mexico-based companies. It separately sanctioned Juan Gabriel Rivas Nunez, whom it described as a senior TdA leader involved in illicit gold mining.
Shared stablecoin laundering routes
Chainalysis said counterparties of the sanctioned wallets had exposure to laundering operations used by Colombian and Mexican drug cartels, as well as Venezuelan launderers. Its investigators said these networks relied heavily on stablecoins to move criminal proceeds internationally.
According to Chainalysis: "The on-chain insights show us that criminal organizations are leveraging common infrastructure for laundering," Senior Intelligence Analyst Kaitlin Martin said in the firm's public analysis.
TRM Labs said the seven listed addresses had received approximately $6.1 million in total inflows since March 2022. Not all that value was necessarily tied to the jackpotting scheme, it said. Most addresses had been dormant for months, with the latest inflow occurring in July 2026.
Chainalysis also said Tether had previously frozen USDT balances on several wallets with exposure to the newly sanctioned addresses.
The sanctions block the designated parties' property in the United States or under U.S. persons' possession or control. Unless licensed or exempt, U.S. persons are generally prohibited from transactions involving that property, Treasury said.
Source: The Defiant
Trading involves risk.
Risk Disclaimer
