OFAC Sanctions Tren de Aragua Network Over Crypto Laundering

The U.S. Treasury’s Office of Foreign Assets Control sanctioned 10 people and entities linked to Tren de Aragua on Sept. 30. Treasury said the network used malware to force U.S. ATMs to dispense cash and moved the proceeds through cryptocurrency, including Tron (TRX).

Reported losses from more than 1,500 alleged jackpotting attacks totaled $40.73 million as of August 2025. Jackpotting involves using malware to make an ATM release cash without recording a withdrawal from a customer’s account.

The alleged operation was organized by Anibal Alexander Canelon Aguirre, known as “Prometheus.” Investigators describe him as the developer of the malware. Canelon Aguirre is an FBI Ten Most Wanted fugitive.

The sanctions list includes Tron wallet addresses linked to seven designated individuals. Canelon Aguirre and six associates were indicted in Nebraska on charges including bank fraud, bank burglary and conspiracy to commit money laundering.

OFAC also designated two Mexican companies, Enigma Community and Soluciones Integrales Toluca. Treasury identified the companies as being owned by suspects in the scheme.

The sanctions block property belonging to the designated parties that is subject to U.S. jurisdiction. They also generally prohibit U.S. persons from conducting transactions with the listed people and entities.

“President Trump’s administration will not allow terrorist organizations like Tren de Aragua to exploit the U.S. financial system,” Treasury Secretary Scott Bessent said in a statement.

The action also designated Juan Gabriel Rivas Nunez, described by Treasury as a senior Tren de Aragua leader. Authorities linked him to gold-mining operations, narcotics exports and violent crime in South America.

The investigation involves the FBI, Homeland Security Investigations, the Financial Crimes Enforcement Network and the Justice Department’s Joint Task Force Vulcan. Treasury reported that the Justice Department had indicted 98 people in the broader jackpotting investigation since October 2025.

Tren de Aragua originated in Venezuela and has expanded across the Western Hemisphere. U.S. authorities have linked the group to drug trafficking, human trafficking, extortion and money laundering. The State Department designated it a foreign terrorist organization in February 2025.