Treasury Sanctions Tren de Aragua ATM Jackpotting Network, Including Seven TRON Addresses

Key takeaways

• The US Department of the Treasury's Office of Foreign Assets Control (OFAC) designated eight individuals and two Mexico-based companies tied to a Tren de Aragua (TdA) ATM jackpotting scheme, along with a TdA leader involved in illicit gold mining, and added seven TRON addresses to the Specially Designated Nationals and Blocked Persons List (SDN List)
• Jackpotting uses malware to force ATMs to dispense cash. According to Treasury, reported losses from alleged TdA jackpotting attacks in the US totaled USD 40.73 million across more than 1,500 attacks as of August 2025.
• The seven designated addresses have received approximately USD 6.1 million in total inflows since March 2022, according to TRM analysis, and sent funds to other TdA-associated addresses
• The designations build on a broader US campaign: since 2025, Treasury has taken more than 30 actions against more than 300 individuals and entities tied to transnational criminal organizations, and since October 21, 2025, the US Department of Justice (DOJ) has indicted 98 individuals in ATM jackpotting schemes
• All seven addresses are deposit addresses hosted at a centralized exchange, so virtual asset service providers (VASPs) and financial institutions should screen for both direct and indirect exposure to them

{{horizontal-line}}

On September 30, 2026, OFAC designated eight individuals and two entities involved in a Tren de Aragua (TdA) fraud scheme that Treasury describes as a key source of revenue for the organization. OFAC also designated a TdA leader involved in illicit gold mining.

The scheme centers on ATM "jackpotting," a type of cyberattack that uses malware to force cash machines to dispense money. According to Treasury, reported losses from alleged TdA jackpotting attacks in the US totaled USD 40.73 million across more than 1,500 attacks as of August 2025.

OFAC's designation adds seven TRON addresses to the SDN List, each attributed to one of the designated individuals. TRM Labs has labeled all seven addresses as sanctioned. The action follows a run of designations that have paired named criminal networks with on-chain identifiers, including OFAC's May 2026 action against a Sinaloa Cartel laundering network, which added six Ethereum addresses to the SDN List.

How the jackpotting scheme works

Treasury defines a jackpotting attack as one in which criminals "exploit vulnerabilities in ATMs and/or interactive teller machines (ITMs) of financial institutions by using malware that forces the ATMs or ITMs to dispense cash without debiting an account." Attacks typically involve surveillance of a target machine, installation of malware, remote activation to bypass security controls, and forced cash dispensing.

While the network is based in Mexico and Venezuela, it targets ATMs in the US. According to Treasury, the stolen funds are laundered — including through cryptocurrency transactions — and transferred to TdA members in various countries.

Since October 21, 2025, DOJ has indicted 98 individuals for their roles in ATM jackpotting schemes, according to Treasury. A June 26, 2026, DOJ press release said the investigation established extensive direct and indirect links between the indicted defendants and TdA.

Who was designated?

The primary target is Anibal Alexander Canelon Aguirre, known as "Prometheus," who appears on the FBI's Ten Most Wanted Fugitives list. According to Treasury, Canelon Aguirre is the alleged engineer of the malware used in the attacks and has been photographed posing with proceeds of the crime.

OFAC also designated six alleged associates of Canelon Aguirre, each of whom is linked to one of the TRON addresses:

• Eric Gabriel Cardenas Arzola
• Jose Dario Galeano Bazurto
• Anthony Wuiliam Hernandez Guerrero
• Carlos Javier Martinez Armenta
• Oscar Leonardo Martinez Pirona
• Alejandro Mejia Castillo

These seven individuals, along with a further designee, Aslhy Javier Galeano Basurto, face charges in the US District Court for the District of Nebraska that include providing material support to TdA, bank fraud conspiracy, bank burglary conspiracy, and money laundering conspiracy. According to Treasury, Galeano Basurto was previously detained in the US in 2017 on suspicion of manipulating ATMs.

According to Treasury, Martinez Armenta has transacted directly with Hector Rusthenford Guerrero Flores, known as "Nino Guerrero," the now-deceased head of TdA. Martinez Pirona has transacted with Venezuelan entertainer Jimena Romina Araya Navarro, whom OFAC previously designated for supporting TdA.

OFAC also designated two Mexico-based companies: Enigma Community, S. de R.L. de C.V., owned by Martinez Pirona, and Soluciones Integrales Toluca, S.A. de C.V., owned by Mejia Castillo.

The action separately targets Juan Gabriel Rivas Nunez, known as "Juancho," whom Treasury describes as a high-ranking TdA leader who directs gold mining, narcotics exporting, and violent crime across multiple South American countries. Rivas Nunez was indicted in the Southern District of Texas in December 2025 on charges of providing material support to TdA.

All charges described in this post are allegations. The defendants are presumed innocent unless and until proven guilty.

Cryptocurrency addresses

• Anibal Alexander Canelon Aguirre: TJjRAn9kLiyh8h6gjBjaYjkfDkskgZfyW9
• Eric Gabriel Cardenas Arzola: TCUmMCHQEbFFdGvfdg2LeS64QfzUKP2AgW
• Jose Dario Galeano Bazurto: THwbVuBBb26abe5TrAsYUpYz9mhWnBppdz
• Anthony Wuiliam Hernandez Guerrero: TBEmt7kPSwAv6NJTYKNdBVW524bUfPwJpJ
• Carlos Javier Martinez Armenta: TCifMAMwst3oEJx8GaNfqZw75dkFUa8vjG
• Oscar Leonardo Martinez Pirona: TDxZ1XTZCmqkJJW2eJT362z6omRchJyGBX
• Alejandro Mejia Castillo: TWJmTGhquvdp1jhBmgeGxBBwefteGZUQYW

TRM will add any further addresses to the sanctioned label as they are identified.

Designated addresses received about USD 6.1 million since 2022

The seven designated addresses have received approximately USD 6.1 million in total inflows since March 2022, according to TRM analysis. Not all of that value is necessarily tied to the jackpotting scheme. The address attributed to Cardenas Arzola accounts for the largest share, about USD 2.1 million.

The seven addresses follow the same pattern: each is a deposit address hosted at a centralized exchange, and each received funds from many sources. Most of the addresses have been dormant for months. The most recent inflow, to the address attributed to Cardenas Arzola, occurred in July 2026. That exchange-hosted deposit pattern is the same one TRM observed in the September 2026 designation of the Xinbi Guarantee marketplace, where illicit value also settled largely in USDT on TRON.

The designated addresses also sent funds to other addresses associated with Tren de Aragua. Those addresses, in turn, sent approximately USD 35 million to a network that US authorities have affiliated with Jorge Figueira, a Venezuelan national charged with laundering approximately USD 1 billion in illicit funds. Figueira has not been convicted, and the charges against him are allegations.

Green represents the Tren de Aragua entity, orange indicates the Jorge Figueira Affiliated Network entity, and grey denotes the newly OFAC-designated addresses.

Treasury's campaign against TdA

Today's action is the latest in a series of Treasury measures against TdA. OFAC designated TdA as a Transnational Criminal Organization on July 11, 2024, and the US Department of State designated it as a Foreign Terrorist Organization on February 20, 2025. OFAC followed with further TdA actions on June 24, July 17, and December 3, 2025. Today's action was taken pursuant to Executive Order (E.O.) 13581, as amended, and E.O. 13224, as amended.

The use of E.O. 13224 places this action in the same counter-terrorism authority OFAC has applied to other Foreign Terrorist Organizations with on-chain infrastructure, including its July 2026 listing of 134 ISKP cryptocurrency addresses.

According to Treasury, the US government's campaign has produced more than 30 actions against more than 300 individuals and entities tied to transnational criminal organizations since 2025. Today's action stems from an investigation coordinated by the Homeland Security Task Force (HSTF) and involving the FBI and Homeland Security Investigations (HSI), in collaboration with the Financial Crimes Enforcement Network (FinCEN), DOJ's Joint Task Force Vulcan and Computer Crime and Intellectual Property Section, and the US Attorney's Office for the District of Nebraska.

Because today's designations were made under E.O. 13224, foreign financial institutions that knowingly conduct or facilitate "any significant transaction" on behalf of the designated persons risk secondary sanctions, including prohibitions or strict conditions on opening or maintaining US correspondent or payable-through accounts.

The action also sits alongside the wider US pressure campaign on Venezuelan networks, which TRM examined in its analysis of the Maduro superseding indictment.

What this means for compliance teams

VASPs and financial institutions should screen against the seven designated TRON addresses and review any historical exposure. Because the on-chain pattern points to exchange-hosted deposit addresses, exchanges may be able to identify the underlying account holders and any related accounts.

Screening should also cover indirect exposure. The designated addresses sent funds to other TdA-associated addresses, so counterparties within one or two hops of the SDN addresses may also carry sanctions risk.

Because all seven addresses are exchange-hosted deposit addresses rather than self-custodied wallets, the immediate compliance work sits with the exchange that holds them and with any VASP that processed funds to or from them. TRM will continue to monitor activity connected to these addresses and to TdA's broader financial network.

{{horizontal-line}}

Frequently asked questions (FAQs)

1. What did OFAC announce on September 30, 2026?

OFAC designated eight individuals and two Mexico-based companies involved in a Tren de Aragua ATM jackpotting scheme, along with Juan Gabriel Rivas Nunez, a TdA leader involved in illicit gold mining. The action added seven TRON addresses to the SDN List.

2. What is ATM jackpotting?

Jackpotting is a cyberattack in which criminals install malware on ATMs or interactive teller machines and activate it remotely, forcing the machine to dispense cash without debiting an account. According to Treasury, reported losses from alleged TdA jackpotting attacks in the US totaled USD 40.73 million across more than 1,500 attacks as of August 2025.

3. How does the TdA jackpotting network use cryptocurrency?

According to Treasury, the network uses cryptocurrency transactions to launder jackpotting proceeds, which are then transferred to TdA members in various countries. The seven designated TRON addresses have received approximately USD 6.1 million since March 2022, according to TRM analysis, and sent funds to other TdA-associated addresses.

4. What are the sanctions implications of the designation?

All property and interests in property of the designated persons that are in the US or in the possession or control of US persons are blocked and must be reported to OFAC. Entities owned 50% or more by one or more blocked persons are also blocked. Because the designations were made under E.O. 13224, foreign financial institutions that knowingly conduct or facilitate "any significant transaction" on behalf of the designated persons risk secondary sanctions.

5. What should compliance teams do in response?

Compliance teams should screen against the seven designated TRON addresses, review historical exposure, and extend screening to indirect exposure within one or two hops. Because the addresses are hosted at a centralized exchange, exchanges may be able to identify the underlying account holders and related accounts.