Treasury sanctions the network behind Tren de Aragua's ATM jackpotting scheme

What happened

On 30 September 2026, the US Office of Foreign Assets Control (OFAC) designated 10 targets tied to a fraud scheme run by Tren de Aragua (TdA), according to a US Treasury press release. The release identifies TdA as a Foreign Terrorist Organization (FTO).

The targets include Anibal Alexander Canelon Aguirre, alias “Prometheus”, and two Mexico-based companies: Enigma Community S. de R.L. de C.V. and Soluciones Integrales Toluca S.A. de C.V. Treasury describes Canelon Aguirre as an alleged malware engineer who orchestrated the operation from Mexico and Venezuela, and as one of the FBI’s ten most wanted fugitives.

Per Treasury, criminals surveilled ATMs, broke into the machines, and installed malware that bypassed security systems. They activated it remotely and forced the ATMs to dispense cash without debiting any account. Treasury puts losses at $40.73 million as of August 2025, across more than 1,500 attacks on US ATMs. It says the funds were laundered through cryptocurrency transactions, transfers among TdA members, and Mexico-based front companies, then sent to TdA members in various countries.

The release says 98 individuals have been indicted since 21 October 2025. Treasury Secretary Scott Bessent said “President Trump’s administration will not allow terrorist organizations like Tren de Aragua to exploit” financial systems. Treasury places the action within more than 30 actions against more than 300 individuals and entities tied to transnational criminal organizations since 2025.

Why it matters

This section is analysis. The release carries two stories. The first is a loss event. Machines that dispense cash without any account being debited suggest the losses land on whoever owns the machines, typically a bank or an ATM operator.

The second is a laundering story. Treasury names cryptocurrency transfers and Mexico-based front companies as the route from stolen cash to TdA members abroad. The likely effect is that proceeds reach institutions as ordinary corporate and crypto-related activity, not as anything labelled fraud.

Designating two operating companies matters for a practical reason. Front companies tend to reach an institution through payments and counterparties, not through a recognisable name at onboarding. Treasury’s count of more than 30 actions since 2025 also suggests a sustained campaign, so further TdA-linked designations are a reasonable expectation.

Practitioner angle

The checks below are analysis for your own controls. They are not red flags published by Treasury.

• ATM fleet. Compare cash dispensed by each machine against matching account debits. A dispense with no ledger entry is the pattern Treasury describes. Reconcile ATM cash counts to the ledger per machine on a short cycle, because an aggregate check can hide one compromised terminal.
• Intrusion and software. Confirm alerting covers cabinet access and unexpected software on ATM endpoints. Make sure third party operators and maintainers feed events into the same view as your own fleet.
• Loss handling. Check whether past unexplained ATM shortfalls were written off as operational loss. Decide who owns the call on a suspicious activity report (SAR) when a shortfall has no explanation. Fraud, physical security, and financial crime should review it together.
• Screening. Screen Canelon Aguirre, the alias “Prometheus”, and both companies against customers, beneficial owners, counterparties, and payment messages. Include the legal suffixes as name variants. Confirm the designations have reached your screening lists, then run a lookback over historical activity.
• Transaction monitoring. Test whether your scenarios would catch corporate accounts that move funds with Mexico-based entities and show little visible trading activity. Test also for customers whose inflows are followed quickly by transfers to crypto services.
• FTO status. Ask sanctions counsel what TdA’s FTO status means for your exposure, escalation path, and reporting. Record the answer.

Start with the screening lookback on all three names.