OFAC Sanctions TdA Jackpotting Network: 7 TRON Addresses Targeted

On September 30, 2026, the U.S. Department of the Treasury, through the Office of Foreign Assets Control (OFAC), sanctioned ten individuals and entities linked to an ATM jackpotting network operating under the aegis of Tren de Aragua (TdA). The action designates seven addresses on the TRON blockchain, marking an unprecedented step in the convergence of physical ATM security, banking malware, and cryptocurrency tracing at the address level.

Prometeo's Command: From Compromised ATMs to Blockchain Addresses

Aníbal Alexander Canelón Aguirre, known as "Prometeo," is the central figure in the operation. He appears on the FBI's Ten Most Wanted Fugitives list and is accused of designing the malware used in the attacks. Treasury says photographs exist showing him with proceeds from the scheme. Six operational associates complete the designated core: Carlos Javier Martínez Armenta, Alejandro Mejía Castillo, José Darío Galeano Bazurto, Eric Gabriel Cárdenas Arzola, Oscar Leonardo Martínez Pirona, and Anthony Wuiliam Hernández Guerrero.

Added to these are Aslhy Javier Galeano Basurto, already indicted in Nebraska, and Juan Gabriel Rivas Núñez, alias "Juancho," identified as a director of TdA's gold-mining operations. Two Mexico-based companies, Enigma Community (owned by Martínez Pirona) and Soluciones Integrales Toluca (owned by Mejía Castillo), are designated as instrumental entities.

According to Treasury, Canelón Aguirre did not merely coordinate; he was the technical architect of the malware. However, this attribution contrasts with a more cautious assessment circulating among security experts: per The Record, independent analysts have not identified verified links between Ploutus and the fugitive or Tren de Aragua. The dossier does not clarify whether Treasury's accusation rests on technical evidence of authorship or on an operational role in distribution.

How Jackpotting Works: XFS, Generic Keys, and Physical Access

ATM jackpotting is not a remote attack. It requires physical access to the machine, obtained with generic keys or lock picks to open the secure cabinet. Inside, operators remove or clone the hard drive, install the malware payload, then restore the hardware. Once connectivity is re-established, remote control triggers the cash-dispense command, bypassing the original software's authorization controls.

Ploutus, the malware cited in the investigations, interacts directly with the XFS (eXtensions for Financial Services) middleware, the software layer that abstracts ATM hardware for banking applications. By exploiting XFS APIs on Windows systems, Ploutus issues direct commands to cash dispensers without transactional authentication. The code's flexibility allows it to be adapted with minimal adjustments to different ATM families.

Treasury does not specify which models or vendors were hit in the TdA-linked attacks. The nature of the malware nonetheless suggests a broad attack surface: any Windows-based ATM with XFS middleware exposes the same interface.

The Seven TRON Addresses: Stablecoins, Exchanges, and Commingled Counterparties

The most technologically significant element of the OFAC designation is the inclusion of seven cryptocurrency addresses on the TRON blockchain. TRM Labs, the blockchain analytics firm cited by Treasury, traced aggregate flows of approximately $6.1 million to these addresses since March 2022. The single most active address, associated with Cárdenas Arzola, received roughly $2.1 million.

The seven addresses follow a recurring pattern: they are deposits at centralized exchanges, not self-custodial wallets. This detail is critical. The designation does not merely target "anonymous" addresses; it aims at the interface layer between stolen physical cash and digital liquidity, where ATM proceeds are converted into stablecoins or other assets traceable on-chain.

"Chainalysis analysis found that counterparties of the [Tren de Aragua] wallets had exposure to laundering operations used by Colombian and Mexican drug cartels, as well as a Venezuelan national charged with laundering one billion dollars"

According to Chainalysis analysis cited by The Record, counterparties of the TdA wallets had exposure to laundering operations used by Colombian and Mexican drug cartels, as well as a Venezuelan national charged with laundering one billion dollars. Another notable data point emerges from TRM Labs: approximately $35 million was sent from addresses associated with TdA to a network linked to Jorge Figueira, a figure already known to investigators.

The dossier does not specify the proportion of the $6.1 million directly attributable to ATM attacks versus other criminal proceeds. The seven addresses may represent a subset of a broader laundering infrastructure.

The Martínez Armenta Trail: From Niño Guerrero to the Blockchain

Among the designees, Carlos Javier Martínez Armenta plays an institutional linking role. According to Treasury, he transacted directly with Héctor Rusthenford Guerrero Flores, alias "Niño Guerrero," the Tren de Aragua leader killed in Venezuela. This transactional node is significant: it not only ties the jackpotting operation to TdA but places it within a shared laundering network spanning other Latin American criminal economies.

Treasury has hit Tren de Aragua with more than thirty actions since 2025, designating over three hundred individuals and entities linked to transnational criminal organizations. Executive Order 13224, invoked in the order, activates the risk of secondary sanctions for foreign financial institutions that maintain dealings with designated entities.

Immediate Actions

• Financial institutions must screen for transactions involving the seven designated TRON addresses on the SDN List and activate mandatory screening protocols for VASPs under U.S. jurisdiction.
• ATM operators should review physical protections for machines, access-key rotation, and XFS middleware segmentation to limit exposure to hardware-injected payloads.
• Centralized exchanges and crypto operators must implement counterparty monitoring to identify indirect exposure to the designated addresses and associated Latin American laundering networks.
• International financial institutions must assess secondary-sanctions risk stemming from E.O. 13224, particularly for relationships with Mexican or Venezuelan entities linked to TdA.

Why This Sanction Redraws the Map

The September 30 OFAC designation marks a turning point in the perception of jackpotting as a "physical" crime separate from cybersecurity. Treasury has traced a complete arc: cash withdrawn from compromised ATMs, conversion into digital assets on TRON, commingling with drug-cartel flows. This is no longer just an ATM theft; it is a case study in the liquefaction of boundaries between cybercrime, organized crime, and transnational finance.

The dossier's limit remains technical attribution. If Prometeo is truly the author of Ploutus, the sanction becomes a precedent for targeting financial-malware developers as primary actors. If Treasury has instead conflated authorship and operational management, the order risks stretching the definition of "developer" in ways that could complicate future investigations. The distinction is not academic: it determines whether jackpotting is a commoditized criminal service or a vertically integrated TdA operation.

The certain fact is that seven blockchain addresses are now legal equivalents of ten individuals and two companies. For industry operators, this is the new standard.

Sources

• https://therecord.media/us-sanctions-10-atm-jackpotting-tren-de-aragua
• https://www.foxbusiness.com/politics/treasury-exposes-terror-network-tren-de-araguas-40m-us-atm-jackpotting-plot
• https://newsroomamerica.com/a/P57GzChZEbtobxr6Sp2wDk2dPSa/ofac_designated_10_targets_tied_to_a_tren_de_aragua_atm_jackpotting_scheme_that_has_stolen_millions_from_u_s_financial_institutions_including_a_fugitive_on_the_fbi_s_ten_most_wanted_list.html
• https://www.trmlabs.com/resources/blog/treasury-sanctions-tren-de-aragua-atm-jackpotting-network-including-seven-tron-addresses
• https://www.miamiherald.com/news/nation-world/world/americas/venezuela/article317443105.html
• https://www.tvcnews.tv/us-sanctions-10-over-tren-de-aragua-atm-theft-scheme/
• https://thedefiant.io/news/regulation/ofac-sanctions-tren-de-aragua-atm-network-lists-seven-tron-addresses
• https://therecord.media/fbi-atm-jackpotting-2025-report
• https://therecord.media/kansas-atm-jackpotting-guilty-pleas
• https://www.foxbusiness.com/

Information verified against cited sources and current as of publication.

Sources