The news
ATM jackpotting, the use of malware to make cash machines spit out money without touching any account, drew a three-part US response. On September 30, 2026, the Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned a financial network it links to Tren de Aragua, the Venezuelan gang the US has designated a foreign terrorist organization.
Treasury's press release names Anibal Alexander Canelon Aguirre, known as "Prometheus" and "The Engineer," as the malware engineer and a leader of the jackpotting scheme. Also designated were Juan Gabriel Rivas Nunez, described by Treasury as a senior Tren de Aragua leader, a group of other individuals, and two Mexico-based companies: Enigma Community, S. de R.L. de C.V. and Soluciones Integrales Toluca, S.A. de C.V. SecurityWeek reported that seven TRON cryptocurrency addresses tied to Canelon Aguirre and his associates were also listed, citing TRM Labs.
Treasury said reported US losses from alleged jackpotting attacks reached $40.73 million as of August 2025, across more than 1,500 incidents. It also said 98 people had been indicted for roles in jackpotting schemes since October 21, 2025. Treasury Secretary Scott Bessent said the department would use "all tools available" against the group's financial facilitators.
The third front is the courtroom. Canelon Aguirre was added to the FBI's Ten Most Wanted Fugitives list in March 2026, and SecurityWeek reported he was the first person placed on that list for cybercrime. According to BleepingComputer, the Justice Department has now announced that he was apprehended and appeared in federal court in Nebraska, where he was charged in December 2025. The Justice Department did not say, in BleepingComputer's account, where he was arrested.
BleepingComputer reported the charges include conspiracy to commit bank fraud, conspiracy to commit money laundering, conspiracy to commit bank burglary and computer fraud, and conspiracy to provide material support to terrorists, with maximum sentences ranging from 5 to 30 years. Prosecutors allege attacks between February 2024 and December 2025 took more than $5.4 million in at least 63 jackpottings against bank ATMs and 54 against credit union ATMs combined, plus another $1.43 million in attempted attacks, according to the outlet. Charges are allegations, and he is presumed innocent unless proven guilty.
The method described by the outlets is physical as much as digital. According to The Record, crews typically targeted remote machines, opened them and connected a laptop to install the malware. Court filings describe Ploutus as built to resist forensic analysis and to delete itself after use, BleepingComputer reported.
The numbers
- Reported US jackpotting losses (as of Aug. 2025, per Treasury)
- $40.73 million
- Jackpotting incidents (per Treasury)
- 1,500+
- People indicted since Oct. 21, 2025 (per Treasury)
- 98
- Stolen in Nebraska case, 63 bank and 54 credit union ATM attacks combined (alleged)
- $5.4 million+
- Attempted attacks in Nebraska case (alleged)
- $1.43 million
Why CEOs should care
For compliance teams, the immediate task is screening. Anyone subject to US sanctions rules must block property of the designated people and companies and avoid dealings with them unless OFAC licenses it, Treasury said. Banks, payment firms and crypto businesses should load the new names, the two Mexican companies and the listed TRON addresses into their screening tools and check for past exposure.
For banks and credit union operators, the case is a reminder that ATM security starts with the cabinet. The attacks described relied on getting physical access to a machine and plugging in a laptop. Operations and security leaders should ask: which terminals sit in remote or unmonitored locations, do they have alarms on the top hatch, are hard drives encrypted, and are the machines running supported software with application whitelisting? Vendors and independent ATM operators should get the same questions.
Boards and CFOs should note that losses averaged more than $100,000 per incident in the Nebraska case, per BleepingComputer. That is a cost worth weighing against upgrades to older machines and monitoring for unusual cash dispensing, especially at credit unions, which the prosecution says were hit 54 times.
The bigger picture
Washington has been treating Tren de Aragua as a terrorism and national security target since designating it a transnational criminal organization in July 2024 and a foreign terrorist organization in February 2025, BleepingComputer noted. That status is why the charges include material support to terrorists, and why the sanctions rely on counterterrorism authority (Executive Order 13224) alongside the transnational crime order (Executive Order 13581). Chainalysis told The Record that the proceeds move through the same stablecoin channels used for drug money, which puts crypto platforms in the compliance picture.
What’s next
Canelon Aguirre's case will proceed in federal court in Nebraska. Watch for further indictments and guilty pleas in the wider jackpotting investigation, for any additional OFAC designations, and for ATM makers and operators issuing hardening guidance to their customers.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
