Independent newsroom

Monday, October 5, 2026

The File

Every claim traces to a primary source. Uncertainty is labeled. Corrections are public.

Justice Department · Monday, October 5, 2026

Accused ATM-hacking leader on the FBI’s Ten Most Wanted list pleads not guilty in Nebraska

The File desk · Oct 5, 2026, 10:35 AM UTC

Status

Confirmed as a court appearance and a not-guilty plea (Justice Department, Oct. 2, 2026). The charges are allegations. He is presumed innocent.

  • Confirmed

    Anibal Alexander Canelon Aguirre appeared Oct. 2 in federal court in Nebraska and pleaded not guilty. He remains detained pending trial.

  • Confirmed

    The malware, the gang tie, and the “leader” label are the government’s allegations.

Federal prosecutors say Anibal Alexander Canelon Aguirre, 50, of Venezuela, wrote the Ploutus malware, which forces ATMs to spit out cash. They tie him to the Tren de Aragua gang. He appeared in federal court in Nebraska on Friday, Oct. 2, and pleaded not guilty to four conspiracy counts, including bank fraud, money laundering, and material support to terrorists. He will stay in custody until trial. Treasury sanctioned him on Sept. 30, which The File reported that week.

The Justice Department’s announcement is dated Oct. 2, 2026. Canelon Aguirre, also called Prometheus and The Engineer, made his initial appearance that day before U.S. Magistrate Judge Michael D. Nelson and entered not guilty pleas. He will remain detained in the District of Nebraska pending trial. Chief U.S. District Judge Brian C. Buescher and Magistrate Judge Ryan C. Carson are presiding.

The FBI added him to its Ten Most Wanted list in March 2026. The department says he was the first cyber criminal on the list, and the 540th person added. A federal grand jury in Nebraska indicted him in December 2025.

The four counts and the maximum prison terms the department lists: conspiracy to commit bank fraud, 30 years; conspiracy to commit bank burglary and computer fraud, 5 years; money-laundering conspiracy, 20 years; conspiracy to provide material support to terrorists, 15 years.

The department says 120 people have been charged in Nebraska in the wider ATM case. Three have been sentenced, to 78, 78, and 96 months. It says the conspiracy targeted or hit ATMs in 47 states and the District of Columbia.

The release does not say where he was caught or how he was brought here. FBI Director Kash Patel is quoted saying he is “back in the United States.” This story does not name a country of arrest.

The department says the case is part of the Homeland Security Task Forces created by

. An indictment is merely an allegation. He is presumed innocent until proven guilty.

Treasury sanctioned him on Sept. 30. The File’s story that day is ofac-tren-de-aragua-atm-jackpotting-sept30. This item is the court appearance, not a new sanctions action.

What is still unknown or disputed

Primary sources

Every claim in this story is drawn from the documents below. If a fetch failed, that is recorded on the card.

  1. Source 1

    Apprehended Venezuelan Tren de Aragua leader on the FBI’s Ten Most Wanted list appears in Nebraska court

    U.S. Department of Justice, Office of Public Affairs · October 2, 2026

    Canelon Aguirre made his initial appearance on Oct. 2 before U.S. Magistrate Judge Michael D. Nelson and entered not guilty pleas to the counts charged. He will remain detained pending trial. Anibal Alexander Canelon Aguirre, 50, of Venezuela, also known as Prometheus. Added to the FBI Ten Most Wanted list in March 2026, the first cyber criminal and the 540th person on the list. Indicted in the District of Nebraska in December 2025. “An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.”

    https://www.justice.gov/opa/pr/apprehended-venezuelan-tren-de-aragua-leader-fbis-top-10-most-wanted-list-appears-nebraska

  2. Source 2

    Treasury sanctions Tren de Aragua ATM jackpotting network

    The File · October 1, 2026

    Earlier story. Treasury designated Canelon Aguirre on Sept. 30, 2026. This Oct. 2 item is the court appearance, not a new sanctions action.

    /story/ofac-tren-de-aragua-atm-jackpotting-sept30