Treasury exposes terror network Tren de Aragua's $40M US ATM 'jackpotting' plot

Treasury crackdown on ATM jackpotting

The Treasury Department is dropping the hammer on a Tren de Aragua fraud scheme accused of using U.S. automated teller machines as a narco-terror piggybank, stealing Americans' cash to fund its transnational terror network. Treasury unleashed a whole-of-government crackdown, targeting the financial network of the violent foreign terrorist organization over a massive, high-tech ATM jackpotting scheme that has siphoned millions from American banks.

“President Trump’s administration will not allow terrorist organizations like Tren de Aragua to exploit the U.S. financial system or enrich themselves through theft and other criminal activity targeting American individuals and businesses,” Secretary of the Treasury Scott Bessent wrote in a statement. “Working alongside our law enforcement partners, we will continue to use all tools available to deny these terrorist financial facilitators the resources they need to operate, weakening their overall criminal enterprise and protecting the integrity of the U.S. economy.”

Federal data shows that reported losses from U.S. ATM jackpotting attacks totaled $40.73 million across more than 1,500 incidents through August 2025. The illicit proceeds are routinely laundered through complex cryptocurrency networks and funneled back to TdA leadership. The Office of Foreign Assets Control designated 10 key targets tied to the criminal network, which relies heavily on custom malware to force automated teller machines across the United States to dispense cash on command.

Targets and international cyberfraud operations

“This is a warning to anyone who finances or does business with TdA: Under President Trump’s leadership, the United States is coming for you and your assets, no matter where you hide,” State Department spokesperson Tommy Pigott said in a statement. “Your days exploiting the American people are coming to an end.”

According to Treasury officials, the sprawling cyberfraud operation has fueled a broader violent enterprise, spanning drug trafficking, human smuggling, and murder-for-hire, making the destruction of TdA's financial infrastructure a top national security priority. At the center of the targeted network is an FBI Top Ten Most Wanted fugitive: Anibal Alexander Canelon Aguirre, widely known by the alias Prometheus. Operating out of Mexico and Venezuela, Prometheus is accused of engineering the malicious software used to bypass physical and digital ATM security systems. Once deployed by criminal crews, the malware forces victim machines to empty their cash vaults until they run dry.

Since October 2025, the Department of Justice has indicted 98 individuals for their roles in the cross-country ATM jackpotting conspiracy, tying the defendants directly to TdA operations. Alongside Prometheus, OFAC sanctioned several key associates and front companies, including Mexico-based businesses Enigma Community and Soluciones Integrales Toluca, as well as high-ranking TdA gold-mining facilitator Juan Gabriel Rivas Nunez.

Coordinated law enforcement actions

The sweeping action is the result of a coordinated investigation by the Homeland Security Task Force, involving the FBI, Homeland Security Investigations, the Financial Crimes Enforcement Network, and the Department of Justice’s Joint Task Force Vulcan. The administration's investigative actions quoted former President Barack Obama's Executive Order 13581 on blocking property of transnational criminal organizations and former President George W. Bush's E.O. 13224 on terrorist designations. President Donald Trump designated TdA as a Foreign Terrorist Organization in February 2025.

“TdA engages in a range of criminal activities, including drug trafficking, immigrant smuggling and human trafficking, extortion, sexual exploitation of women and children, money laundering, and murder-for-hire, among others,” Treasury wrote in a press memo.

Also implicated as associates indicted in the scheme are Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, and Anthony Wuiliam Hernandez Guerrero. They have been charged with providing material support to TdA, bank fraud conspiracy, bank burglary conspiracy, and money laundering conspiracy, using cryptocurrency transactions to facilitate the scheme.