U.S. Treasury Targets Seven TRON Addresses in Tren de Aragua Crackdown
The U.S. Treasury Department has sanctioned 10 targets tied to an alleged ATM jackpotting operation linked to Tren de Aragua, a Venezuelan criminal organization. The action also added seven TRON addresses connected to Anibal Alexander Canelon Aguirre, known as “Prometheus,” an FBI Ten Most Wanted Fugitive.
Treasury said the network used cryptocurrency to launder proceeds stolen from U.S. financial institutions. The sanctions mark another U.S. effort to disrupt financial channels tied to transnational criminal organizations.
How the ATM scheme worked
The alleged operation relied on malware that forced ATMs to dispense cash without debiting customer accounts. Treasury said criminals typically surveilled machines, installed malware, activated it remotely, and then issued commands that emptied the ATMs.
Reported losses from alleged Tren de Aragua jackpotting attacks reached $40.73 million across more than 1,500 incidents as of August 2025. Treasury also said the Justice Department had indicted 98 people for roles in ATM jackpotting schemes since October 2025.
Prometheus allegedly engineered the malware and coordinated crews operating in the United States. The stolen funds then moved among members and associates before being transferred internationally. Cryptocurrency formed part of the network’s alleged laundering process.
Crypto addresses draw compliance attention
Blockchain analysis indicates the seven sanctioned TRON addresses received about $6.1 million in total inflows since March 2022. However, analysts cautioned that not all of those funds can necessarily be linked to the alleged ATM operation.
All seven addresses were deposit addresses hosted by a centralized cryptocurrency exchange. That structure could allow the exchange and other financial institutions to identify account holders and examine related transactions.
The addresses also transferred funds to other wallets associated with Tren de Aragua. Those wallets later moved roughly $35 million to another network that U.S. authorities have linked to Venezuelan national Jorge Figueira, who faces allegations involving large-scale money laundering.
The latest designations could therefore prompt cryptocurrency businesses to review both direct and indirect exposure to the sanctioned addresses. Under the sanctions, financial institutions also face restrictions and potential penalties for transactions involving designated parties.
