OFAC Sanctions Tren de Aragua ATM Network, Lists Seven Tron Addresses

The US Treasury’s Office of Foreign Assets Control (OFAC) on Sept. 30 sanctioned the financial network behind an ATM “jackpotting” scheme it ties to Tren de Aragua, the Venezuelan gang the US treats as a terrorist group. The OFAC list update gives seven of the named men a Tron (TRX) address each, so any crypto firm that screens against the sanctions list can now flag them.

Who was designated

According to the Treasury press release, OFAC designated 10 targets in the scheme: eight men and two Mexico-based companies they own. The main target is Anibal Alexander Canelon Aguirre, known as “Prometheus”, who is on the FBI’s Ten Most Wanted list. Treasury calls him the alleged engineer of the malware.

Jackpotting means breaking into a cash machine, installing malware and triggering it remotely so the machine dispenses cash without debiting any account. The network runs from Mexico and Venezuela but targets ATMs in the US, and Treasury says it launders the proceeds partly through crypto before sending them to gang members abroad. The Justice Department has indicted 98 people over jackpotting schemes since Oct. 21, 2025. The men in this network face charges in Nebraska that include material support to a terrorist group, bank fraud and money laundering conspiracy. All of these are allegations.

OFAC also designated Juan Gabriel Rivas Nunez, alias “Juancho”, whom Treasury describes as a senior gang leader directing gold mining and drug exports in South America.

What the Tron addresses show

Blockchain analytics firm TRM Labs says the seven addresses took in about $6.1 million since March 2022, though not all of it is necessarily linked to the ATM thefts. The address tied to Eric Gabriel Cardenas Arzola received the most, about $2.1 million, and the latest inflow reached it in July 2026. Most of the others have been dormant for months.

The detail that matters for compliance teams: all seven are deposit addresses hosted at a centralized exchange, not self-custody wallets. TRM also traced funds onward to other gang-linked addresses, which then sent about $35 million to a network US authorities link to Jorge Figueira, a Venezuelan charged with laundering about $1 billion. He has not been convicted.

Because the designations use Executive Order 13224, a counter-terrorism order, foreign banks that knowingly handle significant transactions for these men risk losing access to US correspondent accounts.

Part of a longer campaign

OFAC sanctioned Tren de Aragua as a transnational criminal organization on July 11, 2024, and the State Department designated it a Foreign Terrorist Organization on Feb. 20, 2025. Treasury lists three further actions against the group in 2025. Wallet addresses have become a regular part of these listings: TRM notes OFAC added six Ethereum addresses in a May 2026 action against a Sinaloa Cartel laundering network.

Neither Treasury nor TRM mentions a freeze of funds at these addresses. In earlier sanctions cases on Tron, Tether has frozen USDT, its dollar stablecoin, as in the Iran-linked USDT freeze. Platforms can also refuse flagged money on their own, as when NEAR Intents turned away Bitget hack funds. Next to watch: whether the exchange hosting the addresses identifies the account holders, and whether stablecoin issuers act on the new entries.

Sources

• US Treasury, Treasury Sanctions Financial Network of Foreign Terrorist Organization, Tren de Aragua, After Theft of Millions from U.S. Banks, September 30, 2026
• OFAC, Recent Actions: Counter Terrorism and Transnational Criminal Organizations Designations, September 30, 2026
• TRM Labs, Treasury Sanctions Tren de Aragua ATM Jackpotting Network, Including Seven TRON Addresses, September 30, 2026