Venezuelan Cartel Leader Arrested for ATM Jackpotting Scheme
US authorities have arrested Anibal Alexander Canelon Aguirre, a key figure in the Tren de Aragua cartel, for allegedly developing and distributing ATM jackpotting malware.
US authorities have arrested and arraigned Anibal Alexander Canelon Aguirre, a 50-year-old Venezuelan member of the Tren de Aragua (TdA) criminal cartel, on charges related to a sophisticated "jackpotting" scheme. This operation allegedly compromised ATMs with malware, causing them to dispense tens of thousands of dollars in cash. Aguirre is accused of then laundering these illicit proceeds through cryptocurrency networks in Venezuela, Mexico, and Colombia, including the decentralized finance platform TRON.
The Tren de Aragua, which began as a prison gang, has evolved into a multinational criminal enterprise involved in drug trafficking, smuggling, kidnapping, human trafficking, and extortion. Cybercrime has become an increasingly integral part of the cartel's operations, providing a convenient and stealthy method for amassing capital to fund their other illicit activities. "Tren de Aragua is using ATM malware as a terrorist financing tool, then moving the cash onto TRON so it looks like ordinary exchange deposits," Ari Redbord, global head of policy at TRM Labs, told Dark Reading. "That is the same playbook we keep seeing from foreign terrorist organizations (FTOs) with on-chain infrastructure."
Aguirre, also known by the aliases "Prometheus" and "The Engineer," is identified as a leader within the cartel and the principal architect of the Ploutus-D malware. This malware was used to compromise and control the targeted ATMs. According to the US Attorney's Office for the District of Nebraska, the TdA group has hit cash machines in Latin America and North America over the past two years, stealing over $5.1 million from 117 banks and credit unions in the United States during 2024 and 2025.
"We are going after the entire jackpotting network, from ringleaders and malware developers to crews in the US," stated Eugene Kowel, special agent in charge with the FBI's Omaha office. "We will continue to follow the money and surge resources to arrest and apprehend TdA members and leadership." ATM jackpotting, while a significant problem in Latin America, has increasingly targeted US financial institutions, costing an estimated $20 million in 2025 alone. Criminal groups typically implant malware physically into ATMs, enabling remote control to dispense cash to money mules who then convert it to cryptocurrency for laundering.
The US indictment attributes $5.1 million in stolen funds to TdA between February 2024 and December 2025. However, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) indicates a broader scope, reporting over 1,500 jackpotting incidents resulting in $40.7 million stolen as of August 2025. Chainalysis, a blockchain analysis firm, noted that Tren de Aragua has significantly utilized cryptocurrency for laundering, leveraging infrastructure from criminal organizations in Colombia, Mexico, and Venezuela.
The Trump administration designated Tren de Aragua as an FTO in February 2025. Since then, 120 members have been charged, with at least 73 in custody. The District of Nebraska has been at the forefront of investigating and prosecuting this conspiracy, tracing funds back to the cartel and Venezuelan actors. In March, Aguirre was placed on the FBI's "Ten Most Wanted Fugitives" list, marking the first time a cybercriminal received this distinction.
Aguirre was apprehended at sea by the US Coast Guard in September. The laundering of stolen cash highlights the reliance of criminal organizations on cryptocurrency infrastructure. OFAC sanctioned seven TRON addresses in September, which TRM Labs found had been used by various illicit actors. These addresses also routed approximately $35 million to a network associated with Jorge Figueira, who is charged with laundering around $1 billion in illicit funds.
The Ploutus family of malware, designed to compromise ATMs and allow cash dispensing without a card, was first detected in Mexico in 2013. The Ploutus-D variant, specifically, has been central to these jackpotting schemes, enabling significant financial theft by organized crime groups like Tren de Aragua.