The U.S. Treasury Department has placed individuals and companies linked to Tren de Aragua (TdA), a Latin American criminal organization, on its sanctions list for planting malware in automated teller machines to drain cash. The targets include "Prometheus," who is on the FBI's Ten Most Wanted Fugitives list.
The Treasury's Office of Foreign Assets Control (OFAC) said on the 30th that it had designated eight individuals and two Mexico-based companies for taking part in TdA's ATM "jackpotting" operations.
Jackpotting is a technique that uses malware to force an ATM to keep dispensing cash. The Treasury views the scheme as a core revenue source for TdA and said the action aims to cut off a money flow in which criminal proceeds are laundered through cryptocurrency and sent to members of the organization. One of the Mexican companies, Enigma Community, is owned by Alejandro Mejia Castillo.
The central figure is Anibal Alexander Cañelon Aguirre, known as Prometheus. OFAC identified him as the developer of the malware used in the crimes. The Treasury said it had also obtained photographs of him posing with criminal proceeds. In court documents, the malware is referred to as "Ploutus." Six of those sanctioned are close associates of Prometheus and have already been indicted in U.S. federal court. One of them, Oscar Leonardo Martinez Pirona, has a history of transactions with a Venezuelan entertainer previously placed under sanctions.
The damage has been extensive. As of August 2025, more than 1,500 ATM jackpotting incidents had been reported in the United States, with losses totaling $40.73 million (about 55.2 billion won). TRM Labs, a digital asset analytics firm, estimated that the seven TRON addresses added to the sanctions list had received about $6.1 million (about 8.3 billion won) since 2022.
Separately, the Treasury sanctioned Juan Gabriel Rivas Nuñez, known as Juancho, a senior TdA leader. He was involved in illegal gold mining and led the organization's activities across several South American countries.
Assets held in the United States by OFAC-designated targets are frozen, and transactions with U.S. citizens and companies are prohibited. The designations were made under Executive Order 13224 on counterterrorism, meaning foreign financial institutions that knowingly process significant transactions with those named could face secondary sanctions. OFAC designated TdA as a transnational criminal organization in July 2024, and the U.S. government classified it as a foreign terrorist organization in February 2025. The Treasury said it has sanctioned more than 300 individuals and entities through about 30 actions related to transnational criminal organizations since 2025.
