Treasury Sanctions Gang Behind Millions in ATM Jackpotting

The Fraud Scheme & Investigation Details

In a significant move against organized financial crime, the U.S. Treasury Department has officially sanctioned eight individuals linked to the Venezuelan criminal organization Tren de Aragua (TdA). These sanctions are a direct response to the gang's extensive involvement in "ATM jackpotting" attacks, a sophisticated method used to defraud financial institutions. The TdA gang allegedly deploys specialized malware onto Automated Teller Machines (ATMs). This malicious software forces the machines to dispense cash, effectively emptying them. Following the theft, the illicit funds are then laundered and transferred internationally, highlighting the transnational nature of this criminal enterprise. The investigation has identified key figures, including Anibal Alexander Canelon Aguirre, also known as "Prometheus," who is reportedly responsible for developing the Ploutus malware used in these operations. Aguirre has been on the FBI's Ten Most Wanted Fugitives list since March, underscoring the severity of these crimes.

Scope of Victims & Financial Losses

• The U.S. Treasury estimates that Tren de Aragua gang members have stolen approximately $40.73 million from U.S. financial institutions.
• These losses are attributed to over 1,500 alleged ATM jackpotting attacks.
• The Treasury has also identified and sanctioned seven TRON cryptocurrency addresses associated with the gang, which have collectively received around $6.1 million in inflows since March 2022.
• The U.S. Justice Department has charged 98 suspects linked to TdA and ATM jackpotting schemes since October 2025, with potential prison sentences ranging from 20 to 335 years.
• In February, the FBI warned of a surge in ATM malware attacks, with over $20 million stolen in 2025 alone.

Key Takeaways & Prevention

This coordinated action by the U.S. Treasury and other law enforcement agencies demonstrates a strong commitment to combating sophisticated financial fraud. For consumers, the primary takeaway is to remain vigilant about the security of financial transactions. While ATM jackpotting directly targets financial institutions, the broader implications include potential impacts on the availability of cash services and the ongoing efforts to secure the financial ecosystem. It is crucial for individuals to be aware of their surroundings when using ATMs, to report any suspicious activity or malfunctioning machines immediately to the bank, and to monitor their bank statements regularly for any unauthorized transactions. The use of malware and sophisticated techniques by criminal organizations like Tren de Aragua highlights the evolving threat landscape, emphasizing the need for robust security measures by financial institutions and heightened awareness among the public.