Treasury sanctions Tren de Aragua, 10 suspects in $40M ATM ‘jackpotting’ bust

FIRST ON FOX: The Treasury Department is dropping the hammer on a Tren de Aragua (TdA) $40-plus million fraud scheme accused of using U.S. automated teller machines as a narco-terror piggybank, stealing Americans’ cash to fund its transnational terror network.

Treasury, in a First on Fox story Wednesday, unleashed a whole-of-government crackdown, targeting the financial network of the violent foreign terrorist organization (FTO) TdA over a massive, high-tech ATM “jackpotting” scheme that has siphoned millions from American banks.

“President Trump’s administration will not allow terrorist organizations like Tren de Aragua to exploit the U.S. financial system or enrich themselves through theft and other criminal activity targeting American individuals and businesses,” Secretary of the Treasury Scott Bessent wrote in a statement.

“Working alongside our law enforcement partners, we will continue to use all tools available to deny these terrorist financial facilitators the resources they need to operate, weakening their overall criminal enterprise and protecting the integrity of the U.S. economy.”

META REMOVES FACEBOOK GROUP ACCUSED OF HARASSING ICE AGENTS AFTER DOJ PRESSURE

Department of Justice images depict an alleged ATM jackpotting scheme benefiting Tren de Aragua in progress. (U.S. Treasury Department / Fox News)

Federal data shows that reported losses from U.S. ATM jackpotting attacks totaled $40.73 million across more than 1,500 incidents through August 2025. The illicit proceeds are routinely laundered through complex cryptocurrency networks and funneled back to TdA leadership.

The Office of Foreign Assets Control (OFAC) designated 10 key targets tied to the criminal network, which relies heavily on custom malware to force automated teller machines across the United States to dispense cash on command.

“This is a warning to anyone who finances or does business with TdA: Under President Trump’s leadership, the United States is coming for you and your assets, no matter where you hide,” State Department spokesperson Tommy Pigott said in a statement.

“Your days exploiting the American people are coming to an end.”

MOST INFAMOUS CRYPTOCURRENCY FRAUD SCHEMES OF ALL TIME

Images shared by the Treasury Department allegedly show members of Tren de Argua using an ATM fraud scheme to finance transnational terrorist operatons. (U.S. Treasury Department / Fox News)

According to Treasury officials, the sprawling cyberfraud operation has fueled a broader violent enterprise — spanning drug trafficking, human smuggling, and murder-for-hire — making the destruction of TdA’s financial infrastructure a top national security priority.

At the center of the targeted network is an FBI Top Ten Most Wanted fugitive: Anibal Alexander Canelon Aguirre, widely known by the alias “Prometheus.” Operating out of Mexico and Venezuela, Prometheus is accused of engineering the malicious software used to bypass physical and digital ATM security systems. Once deployed by criminal crews, the malware forces victim machines to empty their cash vaults until they run dry.

Since October 2025, the Department of Justice has indicted 98 individuals for their roles in the cross-country ATM jackpotting conspiracy, tying the defendants directly to TdA operations.

Alongside Prometheus, OFAC sanctioned several key associates and front companies — including Mexico-based businesses Enigma Community, S. de R.L. de C.V. and Soluciones Integrales Toluca, S.A. de C.V. — as well as high-ranking TdA gold-mining facilitator Juan Gabriel Rivas Nunez (aka “Juancho”).

HACKER SENTENCED OVER BITCOIN THEFT WORTH BILLIONS

A Treasury Department press release shared images of technology allegedly used by TdA terrorist operatives to steal cash from Americans at ATMs. (U.S. Treasury Department / Fox News)

The sweeping action is the result of a coordinated investigation by the Homeland Security Task Force (HSTF), involving the FBI, Homeland Security Investigations (HSI), the Financial Crimes Enforcement Network (FinCEN), and the Department of Justice’s Joint Task Force Vulcan (JTFV).

The Trump administration’s investigative actions quoted former President Barack Obama’s Executive Order 13581 on blocking property of transnational criminal organizations and former President George W. Bush’s E.O. 13224 on terrorist designations. President Donald Trump designated TdA as a Foreign Terrorist Organization (FTO) in February 2025, shortly after taking office for his second term.

“TdA engages in a range of criminal activities, including drug trafficking, immigrant smuggling and human trafficking, extortion, sexual exploitation of women and children, money laundering, and murder-for-hire, among others,” Treasury wrote in a press memo shared with FOX Business before its public release.

Also implicated as associates indicted in the TdA ATM jackpotting scheme are: Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, and Anthony Wuiliam Hernandez Guerrero.

These tools were acquired during an investigation into alleged TdA terrorist operatives, photos from the Treasury Department show. (U.S. Treasury Department / Fox News)

GET FOX BUSINESS ON THE GO BY CLICKING HERE

They have been charged with providing material support to TdA, bank fraud conspiracy, bank burglary conspiracy, and/or money laundering conspiracy, using cryptocurrency transactions to facilitate the scheme.