The U.S. Treasury's Office of Foreign Assets Control sanctioned 10 targets on Wednesday connected to an ATM jackpotting operation run by Tren de Aragua, the Venezuelan gang designated a Foreign Terrorist Organization by the State Department in February 2025. Seven cryptocurrency addresses belonging to ringleader Anibal Alexander Canelon Aguirre — known as 'Prometheus' — and his associates were named in the action. Prometheus is on the FBI's Ten Most Wanted list and faces charges in Nebraska federal court.
The malware that erases itself
The jackpotting campaign relied on a malware strain called Ploutus, according to the Treasury. The software was configured to erase itself after every attack, a detail that helps explain why investigators have struggled to build cases despite the scale of the losses. Reported U.S. losses from alleged jackpotting attacks reached $40.73 million as of August 2025, spread across more than 1,500 incidents. The scheme targeted ATMs directly, forcing them to dispense cash on command.
OFAC separately sanctioned Juan Gabriel Rivas Nunez, a senior TdA figure linked to illicit gold mining. The designation used Executive Order 13224, which means foreign financial institutions that handle significant transactions for the named individuals risk secondary sanctions. That's the part that tends to get banks' attention.
Where the crypto went
Blockchain analytics firm TRM Labs said the seven addresses function as deposit accounts at a centralized exchange, receiving roughly $6.1 million since March 2022. From there, funds moved to other TdA-linked wallets, which in turn pushed about $35 million to a network connected to Jorge Figueira. Figueira, a Venezuelan national, faces charges of laundering approximately $1 billion. He has not been convicted.
Chainalysis, a competing analytics firm, found that the wallets' counterparties had exposure to a laundering network used by Colombian and Mexican cartels. Tether previously froze USDT balances on several wallets that were exposed to the newly sanctioned addresses, according to the facts of the case.
An exchange that may know its customers
All seven addresses sit at a single centralized exchange, TRM noted. That's significant because the platform may be able to identify the account holders behind them. Whether the exchange cooperates with U.S. authorities — or whether it's based in a jurisdiction that would compel it to — isn't clear from the public record. The sanctions order puts the exchange on notice either way.
The broader pattern here isn't new. TdA has been building out a financial infrastructure that mixes old-school street crime with crypto rails, and U.S. authorities have been playing catch-up. The State Department's FTO designation early last year gave prosecutors more tools, but the gang's operations span multiple countries, which complicates enforcement.
Prometheus remains at large. The FBI is offering a reward for information leading to his capture, and the Nebraska case is pending. For now, the sanctioned addresses are effectively blacklisted — any regulated exchange or bank that touches them risks its own access to the U.S. financial system.
