The United States Department of the Treasury has intensified its financial offensive against transnational organized crime, targeting an intricate network that bridges physical cyberattacks on American infrastructure with borderless digital asset laundering. On September 30, 2026, the Office of Foreign Assets Control (OFAC) designated ten key targets—including seven specific cryptocurrency deposit addresses—tied to the violent Venezuelan mega-gang Tren de Aragua (TdA). At the epicenter of this sprawling illicit enterprise is Anibal Alexander Canelon Aguirre, a high-ranking FBI Top Ten Most Wanted fugitive widely known by the digital alias “Prometheus.” According to federal indictments and blockchain intelligence from firms like Chainalysis, Aguirre allegedly engineered the sophisticated malware used to execute "jackpotting" attacks on automated teller machines (ATMs) across the United States, draining more than $40 million before funneling the illicit proceeds through cryptocurrency exchanges and stablecoin networks.
The crackdown underscores a dangerous convergence in modern cybercrime: transnational cartels and foreign terrorist organizations utilizing shared, highly professionalized digital laundering rails to monetize physical theft. As global law enforcement agencies race to adapt to the speed of blockchain transactions, the unmasking of the Prometheus network highlights how heavily armed street gangs have evolved into digitally savvy financial syndicates, leveraging stablecoins to move capital seamlessly from the American heartland to Latin America.
Anatomy of the ATM Jackpotting Campaign: The Mechanics of Ploutus
The financial pipeline feeding Tren de Aragua’s criminal operations relied heavily on a specialized cyber-physical attack vector known as "jackpotting." Unlike traditional skimming devices designed to steal consumer card data for future unauthorized purchases, jackpotting targets the physical and logical architecture of the ATM itself, compelling the machine to spontaneously dispense vast quantities of physical currency without debiting any customer account.
Federal court filings from a landmark December 2025 indictment detail the methodical and disciplined approach employed by Aguirre and his crews. The criminal enterprise operated through specialized cells deployed into the United States from hubs in Mexico and Venezuela. Operating with paramilitary precision, the syndicates divided labor across distinct operational phases. The reconnaissance team photographed target ATMs, meticulously evaluating physical vulnerabilities and checking for silent hood alarms. Once a target was cleared, a specialized technical crew physically breached the ATM housing, unbolted or removed the machine’s internal hard drive, and directly connected a Raspberry Pi microcomputer to install the Ploutus malware strain.
Ploutus represented a formidable challenge for forensic investigators. Engineered to execute deep-level commands within the ATM’s operating system, the malware featured an advanced self-delete function. Once the cash was dispensed and collected by a third recovery crew, the software wiped all digital traces of its presence from the machine’s logs, severely hampering traditional forensic recovery efforts by local law enforcement.
The financial toll of these coordinated strikes was staggering. By August 2025, cumulative reported losses stemming from the nationwide jackpotting campaign surpassed $40.73 million, distributed across more than 1,500 distinct attacks on financial institutions throughout the United States. These multi-million-dollar windfalls provided the liquid capital necessary to fuel TdA’s broader regional violence, extortion, and human trafficking networks.
The Digital Footprint: Tracing Proceeds Through Crypto Exchanges
Once physical cash was harvested from compromised ATMs across the U.S., the conspirators faced a classic money laundering challenge: transforming millions of dollars in physical bills into clean, mobile, and untraceable digital value. To achieve this, Aguirre and his primary associates established a complex web of digital asset deposit addresses at major centralized cryptocurrency exchanges.
OFAC’s September 2026 designations directly targeted seven distinct cryptocurrency addresses controlled by Aguirre and six key co-conspirators: Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, and Anthony Wuiliam Hernandez Guerrero.
Blockchain analytics conducted by Chainalysis revealed that these sanctioned wallets did not operate in a vacuum. Instead, investigators tracked the on-chain counterparties of the TdA-linked addresses, discovering deep structural ties to established, multi-billion-dollar international money laundering operations. The digital trails intersected with laundering networks previously leveraged by Colombian and Mexican drug cartels, as well as separate illicit financial infrastructure managed by high-profile criminal actors, including a Venezuelan national previously indicted for laundering approximately one billion dollars in illicit funds.
Security analysts emphasize that while criminals frequently turn to stablecoins—such as Tether (USDT)—to protect their accumulated wealth from market volatility, the inherent transparency of public ledgers leaves them uniquely vulnerable to real-time intervention. Industry leaders have begun weaponizing this transparency. Prior to the formal OFAC announcement, private sector interventions—including proactive freezing actions by Tether on wallet addresses exhibiting exposure to the sanctioned network—demonstrated how public-private cooperation can disrupt criminal balance sheets in real-time.
A Chronology of Escalation: From Street Gang to Designated Terrorist Organization
The systemic targeting of Tren de Aragua marks a definitive shift in U.S. national security priorities regarding Latin American transnational criminal groups.
February 2025: The United States Department of State formally designates Tren de Aragua as a Foreign Terrorist Organization (FTO), acknowledging the group’s evolution from a Venezuelan prison gang into a hemispheric syndicate engaged in widespread human trafficking, narcotics distribution, and extreme violence.
August 2025: Cumulative financial losses resulting from the nationwide ATM jackpotting campaign reach an estimated $40.73 million, triggering intensified multi-agency task force investigations led by the FBI, the Department of Justice, and financial intelligence units.
December 2025: Federal prosecutors unveil a comprehensive multi-million-dollar indictment against Anibal Alexander Canelon Aguirre and his inner circle, laying bare the mechanics of the Ploutus malware deployment and linking the cyber-heists directly to TdA financing.
May 2026: Financial intelligence tracking highlights an alarming regional trend across Latin America, revealing that major cartels and gangs are increasingly relying on unified, cross-border crypto laundering infrastructure to obscure illicit revenues.
September 30, 2026: OFAC formally designates ten specific targets connected to the ATM financing scheme, including Aguirre—now listed among the FBI’s Ten Most Wanted Fugitives under the moniker "Prometheus"—and seven associated cryptocurrency deposit addresses. This action brings the current administration’s total tally to over 30 distinct financial sanctions actions targeting more than 300 individuals and entities linked to transnational cartels since 2025.
Industry Reactions and the Future of Compliance
The convergence of cybercrime, cryptocurrency laundering, and traditional organized crime has fundamentally altered the compliance landscape for digital asset exchanges and financial institutions operating globally.
“The on-chain insights show us that criminal organizations are leveraging common infrastructure for laundering,” noted Kaitlin Martin, Senior Intelligence Analyst at Chainalysis. “These are insights that only the blockchain can provide.”
Security experts note that as regulatory frameworks tighten across Latin America and the United States, transnational criminal groups are forced to adapt, utilizing decentralized finance protocols, peer-to-peer exchangers, and privacy-enhancing technologies to evade detection. However, the unprecedented velocity of blockchain intelligence sharing allows sanctions compliance teams to identify and quarantine tainted assets long before they can be successfully integrated into the legitimate financial system.
For law enforcement, the hunt for "Prometheus" remains ongoing. Anibal Alexander Canelon Aguirre continues to elude capture, standing as a prominent symbol of the modern hybrid criminal: an individual capable of marrying low-tech physical break-ins with sophisticated, high-tech financial evasion. As U.S. authorities and private analytics firms continue to map out the digital architecture of Tren de Aragua, the net is steadily tightening around both the foot soldiers on the ground and the fugitive masterminds orchestrating the syndicate’s global finances from the shadows.
