Treasury / OFAC · Thursday, October 1, 2026
Treasury sanctions Tren de Aragua ATM “jackpotting” network
The File desk · Oct 1, 2026, 10:15 AM UTC
Status
Confirmed (Treasury press release sb0640 and OFAC recent actions, Sept. 30, 2026)
On Sept. 30, 2026, the Treasury Department’s Office of Foreign Assets Control designated 10 targets tied to a Tren de Aragua scheme that uses malware to force ATMs to spit out cash, then moves the money, often through crypto. Treasury names Anibal Alexander Canelon Aguirre (“Prometheus”), who is on the FBI Ten Most Wanted list, and high-ranking Tren de Aragua leader Juan Gabriel Rivas Nunez (“Juancho”). Treasury cites $40.73 million in reported U.S. ATM jackpotting losses as of August 2025 and notes Justice Department indictments of 98 people since October 2025. The designations cite Legal instrument Lets Treasury freeze assets of major cross-border crime groups and people who help them. Legal instrument Blocks property of designated terrorists and supporters; can also pressure foreign banks that deal with them.Executive Order 13581 (as amended)
Executive Order 13224
On Sept. 30, 2026, the Treasury Department’s Office of Foreign Assets Control designated 10 targets.
Treasury says the targets are tied to a Tren de Aragua scheme that uses malware to force ATMs to dispense cash. The department calls that jackpotting.
Treasury says the money is then moved, often through crypto.
The release names Anibal Alexander Canelon Aguirre, also called Prometheus. Treasury says he is on the FBI Ten Most Wanted list.
It also names Juan Gabriel Rivas Nunez, also called Juancho, and describes him as a high-ranking Tren de Aragua leader.
Treasury cites $40.73 million in reported U.S. ATM jackpotting losses as of August 2025.
Treasury notes Justice Department indictments of 98 people since October 2025.
The action is taken under Legal instrument Lets Treasury freeze assets of major cross-border crime groups and people who help them. Legal instrument Blocks property of designated terrorists and supporters; can also pressure foreign banks that deal with them.Executive Order 13581 (as amended)
Executive Order 13224
The Office of Foreign Assets Control posted the designations on its recent-actions page for Sept. 30, 2026.
This is a sanctions designation. It is not a new criminal conviction.
What is still unknown or disputed
- Which of the 10 names were newly designated on this action versus already listed.
- How much of the $40.73 million Treasury attributes to this specific network.
Primary sources
Every claim in this story is drawn from the documents below. If a fetch failed, that is recorded on the card.
Source 1
Treasury sanctions Tren de Aragua ATM jackpotting network
U.S. Department of the Treasury · September 30, 2026
Press release sb0640, Sept. 30, 2026. Ten targets designated. Names Anibal Alexander Canelon Aguirre (“Prometheus”) and Juan Gabriel Rivas Nunez (“Juancho”). Cites $40.73 million in reported U.S. ATM jackpotting losses as of August 2025 and Justice Department indictments of 98 people since October 2025. Actions under
andLegal instrument
Executive Order 13581 (as amended)
Lets Treasury freeze assets of major cross-border crime groups and people who help them.
.Legal instrument
Executive Order 13224
Blocks property of designated terrorists and supporters; can also pressure foreign banks that deal with them.
https://home.treasury.gov/news/press-releases/sb0640
Source 2
OFAC recent actions, Sept. 30, 2026
Office of Foreign Assets Control · September 30, 2026
Recent-actions page for the Sept. 30, 2026 designations.
https://ofac.treasury.gov/recent-actions/20260930