Seven TRON Addresses Sanctioned Over Alleged Tren de Aragua ATM Jackpotting Scheme That Cost U.S. Machines 40.73 Million

The U.S. Treasury Department has sanctioned seven TRON blockchain addresses tied to an alleged ATM jackpotting operation run by the Tren de Aragua gang — a scheme U.S. authorities link to more than 40.73 million USD in losses across over 1,500 attacks on American cash machines.

By Maria Rodriguez | October 1, 2026

The Hook: A Gang, a Cash Machine, and a Blockchain Trail

The Treasury’s Office of Foreign Assets Control (OFAC) added the seven addresses to its Specially Designated Nationals and Blocked Persons List as part of a broader action against eight individuals and two Mexico-based companies. The alleged scheme is called ATM jackpotting — criminals install malware on an ATM or interactive teller machine that forces it to spit out cash without debiting any bank account, like rigging a slot machine that always pays out. According to the Treasury account cited by blockchain intelligence firm TRM Labs, attackers typically monitor a target machine first, then install malware that is remotely activated to bypass security controls.

The network allegedly operates from Mexico and Venezuela while targeting machines in the United States, with stolen funds laundered through several methods — including cryptocurrency — before reaching Tren de Aragua members in different countries.

What the Blockchain Actually Showed

TRM Labs traced approximately 6.1 million USD in total inflows to the seven sanctioned TRON addresses since March 2022, while cautioning that not all of those funds were necessarily connected to the alleged ATM scheme. The largest share — roughly 2.1 million USD — went to the address attributed to Eric Gabriel Cardenas Arzola. Most of the addresses have sat dormant for months, with the most recent identified inflow landing in July 2026.

• 6.1 million USD — total inflows to the seven sanctioned TRON addresses since March 2022, per TRM Labs.
• 40.73 million USD — reported U.S. losses from more than 1,500 alleged Tren de Aragua jackpotting attacks as of August 2025.
• 35 million USD — value sent onward from connected addresses to a network U.S. authorities affiliate with a Venezuelan national charged with laundering roughly 1 billion USD in illicit funds.
• 98 indictments — people charged by the Department of Justice over alleged ATM jackpotting roles since October 21, 2025.

The Core Detail: These Were Exchange Accounts, Not Personal Wallets

Here is the detail that matters most for anyone who uses crypto: TRM found that all seven TRON addresses were deposit addresses hosted by a centralized crypto exchange. In plain terms, the alleged participants were not hiding in self-custody wallets they fully control — they were using accounts at a regulated intermediary, like keeping money at a bank rather than under a mattress. That gives investigators a direct path to identify the underlying account holders and follow the money further.

The pattern echoes a similar TRON-based scheme TRM identified in September involving the Xinbi Guarantee marketplace — one of Southeast Asia’s largest illicit crypto markets with roughly 24.2 billion USD in transactions since 2022 — where exchange-hosted deposit addresses were used and value largely settled through USDT on TRON. Tether subsequently froze 39.3 million USD in USDT across 10 TRON addresses linked to that network.

Who Was Sanctioned and What Happens Next

The main target of the action is Anibal Alexander Canelon Aguirre, identified as “Prometheus,” whom Treasury alleges engineered the malware used in the attacks. Six alleged associates were designated alongside him, with OFAC linking each of the seven individuals to one of the TRON addresses. The defendants face charges in the U.S. District Court for the District of Nebraska, including providing material support to Tren de Aragua, bank fraud conspiracy, bank burglary conspiracy and money laundering conspiracy. A separate Tren de Aragua leader accused of involvement in illicit gold mining was designated in the same action.

Being placed on the SDN list means U.S. persons are generally prohibited from transacting with the listed individuals and entities, and any of their assets within U.S. jurisdiction are frozen. For the exchanges hosting those deposit addresses, the designations create a legal obligation to block the linked accounts.

What This Means for You

For law-abiding crypto users, the practical takeaway is twofold. First, sanctions enforcement increasingly follows the blockchain itself — the same public transparency that lets investigators trace gang money also means ordinary users’ transactions are visible. Second, the case underlines that centralized exchanges sit at the chokepoint: nearly every high-profile enforcement action this year, from Xinbi to this one, ran through exchange-hosted deposit addresses rather than unhosted wallets.

The verdict: this is a law-enforcement story, not a TRON protocol failure — the network worked exactly as designed, publicly and immutably, which is precisely what let investigators follow the trail. But it is a reminder that the gap between “crypto is anonymous” folklore and the reality of traceable, exchange-mediated finance keeps narrowing with every designation.

The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.