OFAC Sanctions Tren de Aragua ATM Network, Lists Seven Tron Addresses

The U.S. Treasury’s Office of Foreign Assets Control sanctioned 10 people and businesses tied to an alleged Tren de Aragua ATM-theft network on Sept. 30, 2026. Treasury said the network stole millions from U.S. financial institutions, citing reported U.S. ATM “jackpotting” losses of $40.73 million across more than 1,500 attacks as of August 2025.

The action added seven Tron addresses to OFAC’s Specially Designated Nationals list. Chainalysis identified them as deposit addresses at a major crypto exchange and traced their counterparties’ exposure to shared laundering networks.

Among those sanctioned is Anibal Alexander Canelon Aguirre, known as “Prometheus,” whom the FBI added to its Ten Most Wanted Fugitives list in March. Treasury alleges he engineered the malware used in the attacks and used cryptocurrency to launder the proceeds.

In jackpotting attacks, criminals physically access cash machines, install malware and activate it remotely to force cash withdrawals without debiting an account, Treasury said. It said the targeted network, based in Mexico and Venezuela, laundered the stolen funds and transferred them to TdA members in multiple countries.

The ATM-related designations cover eight individuals and two Mexico-based companies. Treasury separately sanctioned Juan Gabriel Rivas Nunez, whom it described as a senior TdA leader involved in illicit gold mining.

Shared Stablecoin Laundering Routes

Chainalysis said counterparties of the sanctioned wallets had exposure to laundering operations used by Colombian and Mexican drug cartels, as well as Venezuelan launderers. Its investigators said these networks relied heavily on stablecoins to move criminal proceeds internationally.

“The on-chain insights show us that criminal organizations are leveraging common infrastructure for laundering,” Chainalysis Senior Intelligence Analyst Kaitlin Martin said in the firm’s public analysis.

In a separate analysis, TRM Labs said the seven listed addresses had received approximately $6.1 million in total inflows since March 2022. Not all that value was necessarily tied to the jackpotting scheme, it said. Most addresses had been dormant for months, with the latest inflow occurring in July 2026.

Chainalysis also said Tether had previously frozen USDT balances on several wallets with exposure to the newly sanctioned addresses.

The Seven Listed Addresses

OFAC’s notice labels each identifier “Digital Currency Address - TRX” and associates it with the following individual:

- **Anibal Alexander Canelon Aguirre:** `TJjRAn9kLiyh8h6gjBjaYjkfDkskgZfyW9` - **Eric Gabriel Cardenas Arzola:** `TCUmMCHQEbFFdGvfdg2LeS64QfzUKP2AgW` - **Jose Dario Galeano Bazurto:** `THwbVuBBb26abe5TrAsYUpYz9mhWnBppdz` - **Anthony Wuiliam Hernandez Guerrero:** `TBEmt7kPSwAv6NJTYKNdBVW524bUfPwJpJ` - **Carlos Javier Martinez Armenta:** `TCifMAMwst3oEJx8GaNfqZw75dkFUa8vjG` - **Oscar Leonardo Martinez Pirona:** `TDxZ1XTZCmqkJJW2eJT362z6omRchJyGBX` - **Alejandro Mejia Castillo:** `TWJmTGhquvdp1jhBmgeGxBBwefteGZUQYW`

The sanctions block the designated parties’ property in the United States or under U.S. persons’ possession or control. Unless licensed or exempt, U.S. persons are generally prohibited from transactions involving that property, Treasury said.