US sanctions eight Tren de Aragua members over ATM hacks

The U.S. Treasury Department sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) over their alleged role in ATM jackpotting attacks across the United States. The attacks have stolen millions of dollars, according to the department.

In jackpotting, criminals install malware on automated teller machines (ATMs) to make them dispense cash. Treasury said the stolen funds are laundered and transferred to TdA members in several countries. It identified Anibal Alexander Canelon Aguirre, known as “Prometheus,” and six associates among those designated. Aguirre allegedly developed the Ploutus malware used in ATM hacks and has been on the FBI’s Ten Most Wanted Fugitives list since March.

The Office of Foreign Assets Control (OFAC) said the sanctions are part of a sustained government campaign that has taken more than 30 actions against over 300 people and entities linked to transnational criminal organizations since 2025. Treasury designated TdA a Transnational Criminal Organization in July 2024; the State Department designated it a Foreign Terrorist Organization in February 2025.

According to TRM Labs, Treasury also added seven TRON addresses to its Specially Designated Nationals and Blocked Persons List. The addresses received about $6.1 million in total inflows since March 2022 and sent funds to other TdA-associated addresses.

OFAC estimates that, as of August 2025, TdA members had stolen $40.73 million from U.S. financial institutions in more than 1,500 alleged ATM jackpotting attacks.