The U.S. Treasury’s Office of Foreign Assets Control has sanctioned 10 targets linked to what it described as Tren de Aragua’s ATM jackpotting operation, including seven cryptocurrency addresses attributed to the network’s alleged ringleader and associates. Treasury said the group used crypto among several methods to launder proceeds from the scheme.

The sanctions identify “Prometheus” as Anibal Alexander Canelon Aguirre, an FBI Most Wanted fugitive whom Treasury described as the alleged engineer behind the jackpotting malware. According to Treasury, losses in the United States tied to the alleged attacks had reached $40.73 million as of August 2025, spanning more than 1,500 incidents.

Treasury action targets people and wallets

OFAC’s action covers 10 sanctioned targets connected to the alleged scheme. Among them are seven crypto addresses that Treasury said belong to Prometheus and his associates. Treasury also sanctioned Juan Gabriel Rivas Nunez, described as a senior Tren de Aragua leader linked to illicit gold mining.

The jackpotting scheme referenced by Treasury involves malware used to force ATMs to dispense cash. In this case, US authorities allege that proceeds from those attacks were later moved through cryptocurrency as part of a broader laundering effort.

Prometheus tied to Nebraska case

Treasury identified Prometheus as Anibal Alexander Canelon Aguirre and said he faces charges in federal court in Nebraska. The agency described him as the key technical figure behind the malware used in the operation, though the sanctions announcement frames those findings as allegations by US authorities rather than adjudicated facts.

The scale cited by Treasury is significant: $40.73 million in reported US losses and more than 1,500 incidents by August 2025. Those figures provide the clearest public estimate in the announcement of the damage attributed to the alleged jackpotting activity.

Blockchain firms traced exchange deposits and wider links

TRM Labs said all seven listed addresses appear to be deposit accounts at centralized exchanges. The firm estimated that about $6.1 million had moved through them since March 2022, while cautioning that not all of that activity can be definitively tied to jackpotting proceeds.

TRM also reported that the sanctioned wallets sent funds to other wallets linked to Tren de Aragua. Those wallets, in turn, moved roughly $35 million to a network that authorities have linked to Jorge Figueira, a Venezuelan national facing charges related to laundering about $1 billion.

Separately, Chainalysis said counterparties interacting with the sanctioned wallets showed exposure to a laundering network used by Colombian and Mexican cartels. According to that analysis, the on-chain patterns suggest criminal groups may be using overlapping infrastructure, with stablecoins playing a major role in those flows.

Sanctions implications for exchanges and banks

Treasury used Executive Order 13224 for the designations, a choice that carries broader compliance consequences. Under that authority, foreign financial institutions that knowingly conduct significant transactions for sanctioned persons can face secondary sanctions.

TRM said the exchange hosting the seven deposit addresses may be able to identify the account holders behind them. The analytics firm also noted that Tether had previously frozen USDT balances on several wallets that were exposed to the sanctioned addresses, indicating that some related funds had already come under restrictions before OFAC’s latest action.

What comes next

The immediate confirmed step is that the listed people and wallet addresses are now under OFAC sanctions, and firms that screen customers and blockchain transactions will be expected to block or report relevant activity as required. The action also raises the compliance risk for any foreign institution found to be handling significant transactions for the designees.

Beyond the designations, the public record in this case now rests on Treasury’s allegations, the Nebraska charges cited against Canelon Aguirre, and blockchain tracing published by TRM Labs and Chainalysis. Further enforcement steps or court outcomes would be needed to resolve those claims more fully.

Source: beincrypto.com