The U.S. Treasury Department has imposed sanctions on 10 targets connected to an alleged ATM jackpotting operation attributed to Tren de Aragua, a Venezuelan criminal organization. The action also added seven TRON blockchain addresses linked to Anibal Alexander Canelon Aguirre, known as “Prometheus,” who appears on the FBI's Ten Most Wanted Fugitives list.

According to Treasury, the network used cryptocurrency to launder proceeds stolen from U.S. financial institutions. The designations, announced in an official press release, mark the latest U.S. effort to disrupt financial channels tied to transnational criminal organizations. By extending the action to wallet addresses, Treasury also pushed it onto the public blockchain layer, where transfers involving the listed wallets are recorded on an open ledger that anyone, including compliance systems, can inspect.\n### How the ATM scheme worked

The alleged operation relied on malware that forced ATMs to dispense cash without debiting customer accounts. Treasury said criminals typically surveilled targeted machines, installed malware, activated it remotely, and then issued commands that emptied the ATMs.

Reported losses from the alleged Tren de Aragua jackpotting attacks reached $40.73 million across more than 1,500 incidents as of August 2025. Treasury also said the Justice Department has indicted 98 people for roles in ATM jackpotting schemes since October 2025.

Prometheus allegedly engineered the malware and coordinated crews operating in the United States. Stolen funds then moved among members and associates before being transferred internationally, with cryptocurrency forming part of the network's alleged laundering process — a combination of physical-world theft and on-chain money movement that U.S. authorities have pursued through both sanctions and criminal indictments.

Crypto addresses draw compliance attention

Blockchain analysis from TRM Labs indicates that the seven sanctioned TRON addresses received about $6.1 million in total inflows since March 2022. Analysts cautioned, however, that not all of those funds can necessarily be linked to the alleged ATM operation.

All seven addresses were deposit addresses hosted by a centralized cryptocurrency exchange. That structure could allow the exchange and other financial institutions to identify account holders and examine related transactions. Once published, such listings also feed the sanctions-screening systems that exchanges and payment firms rely on to flag direct or indirect exposure automatically.

The addresses also transferred funds to other wallets associated with Tren de Aragua. Those wallets later moved roughly $35 million to another network that U.S. authorities have linked to Venezuelan national Jorge Figueira, who faces allegations involving large-scale money laundering.

The latest designations could prompt cryptocurrency businesses to review both direct and indirect exposure to the sanctioned addresses. Under the sanctions, financial institutions face restrictions and potential penalties for transactions involving designated parties. The roughly $35 million that flowed to the Figueira-linked network, alongside the accumulating federal jackpotting indictments, gives investigators and compliance teams concrete threads to follow as enforcement continues.

Source: CryptoMeter io