OFAC sanctions 10 Tren de Aragua-linked targets, lists 7 crypto addresses

The US Treasury's Office of Foreign Assets Control (OFAC) sanctioned 10 targets on Wednesday over links to an alleged ATM jackpotting scheme run by Tren de Aragua (TdA). The action also listed 7 crypto addresses belonging to alleged ringleader Anibal Alexander Canelon Aguirre, known as "Prometheus," and his associates. The network allegedly laundered stolen cash through cryptocurrency and other channels. TdA originated in Venezuela, and the State Department designated it a Foreign Terrorist Organization in February 2025. Treasury said ATM fraud has become a key revenue source for TdA. Jackpotting attacks use malware to make ATMs release cash without debiting an account. Nebraska court filings identify the malware strain as Ploutus and say it was set to erase itself after each attack. Treasury identified Canelon Aguirre as the alleged engineer of the malware. Canelon Aguirre is on the FBI's Ten Most Wanted Fugitives list and faces charges in Nebraska federal court. Treasury said reported US losses from alleged jackpotting attacks reached $40.73 million across more than 1,500 incidents as of August 2025. OFAC separately sanctioned Juan Gabriel Rivas Nunez, a senior TdA leader linked to illicit gold mining. TRM Labs said each of the 7 listed addresses is a deposit account at a centralized exchange. TRM Labs said the addresses received about $6.1 million since March 2022, though not all of it necessarily relates to jackpotting. The addresses also sent funds to other TdA-linked wallets. Those other wallets moved roughly $35 million to a network US authorities link to Jorge Figueira. Figueira, a Venezuelan national, faces charges of laundering about $1 billion and has not been convicted. Chainalysis found that counterparties of the listed wallets had exposure to a laundering network used by Colombian and Mexican cartels. Chainalysis analyst Kaitlin Martin said criminal organizations use shared infrastructure for laundering. Chainalysis said these networks rely heavily on stablecoins. Tether had previously frozen USDT balances on several wallets exposed to the newly listed addresses. Because OFAC used Executive Order 13224, foreign financial institutions risk secondary sanctions if they knowingly handle significant transactions for the designees. TRM Labs said the exchange hosting all 7 addresses may be able to identify the account holders.