The U.S. Department of the Treasury has imposed sanctions on a network believed to be responsible for ATM jackpotting incidents across the United States. This network, allegedly linked to the Tren de Aragua gang, has been accused of utilizing malware to empty cash machines, resulting in reported losses totaling $40.7 million from over 1,500 occurrences by August 2025.
Understanding ATM Jackpotting Techniques
ATM jackpotting is a sophisticated method used by criminals to make ATMs dispense cash without debiting a customer’s account. Typically, perpetrators conduct reconnaissance, install malicious software, and remotely trigger cash withdrawals. Recent guilty pleas in ATM jackpotting cases highlight the combination of physical ATM access and software manipulation used in these operations.
In addition to traditional methods, the operation reportedly involved the utilization of cryptocurrency transactions to move illicitly acquired funds. TRM Labs’ analysis, shared with Cyber Security News, revealed that seven sanctioned TRON cryptocurrency addresses had received approximately $6.1 million since March 2022.
Sanctioned Individuals and Entities
On September 30, 2026, sanctions were levied against eight individuals and two companies associated with the alleged scheme. Among those targeted is Anibal Alexander Canelon Aguirre, known as “Prometheus,” identified as the purported mastermind behind the malware used in the heists. He is also listed on the FBI’s Ten Most Wanted Fugitives list for his alleged role in developing the software.
Additional individuals implicated include Eric Gabriel Cardenas Arzola, Jose Dario Galeano Bazurto, Anthony Wuiliam Hernandez Guerrero, Carlos Javier Martinez Armenta, Oscar Leonardo Martinez Pirona, and Alejandro Mejia Castillo. All are connected to specific cryptocurrency addresses. The designated entities, Enigma Community, S. de R.L. de C.V. and Soluciones Integrales Toluca, S.A. de C.V., are linked to the scheme’s operations.
Cryptocurrency’s Role in Financial Crime
TRM Labs’ investigation found that the TRON addresses were hosted at a centralized exchange, with most remaining dormant for several months. The address linked to Cardenas Arzola received around $2.1 million, marking the largest portion of funds. It’s important to note that not all received funds are confirmed proceeds of ATM jackpotting.
Funds from the designated addresses were also transferred to other accounts associated with the Tren de Aragua, which further transferred approximately $35 million to networks allegedly controlled by Jorge Figueira, accused of laundering $1 billion. This highlights a broader pattern of using cryptocurrency exchanges to facilitate illegal financial transactions globally.
The Treasury’s action underscores the importance of financial institutions conducting rigorous assessments of transactions linked to designated individuals or entities. Institutions found to be knowingly facilitating substantial transactions for these parties could face secondary sanctions.
Designated individuals’ assets under U.S. jurisdiction are now blocked, and they face strict reporting obligations to the Office of Foreign Assets Control. This move aims to curb the financial operations of those involved and safeguard the financial system from illicit activities.
