What happened
The U.S. Treasury's Office of Foreign Assets Control (OFAC) has added seven TRON cryptocurrency addresses to its Specially Designated Nationals and Blocked Persons List, targeting a network connected to Tren de Aragua (TdA) — the Venezuela-origin transnational criminal organization — over an ATM jackpotting scheme and related illicit crypto mining activity linked to an estimated $40.7 million in losses.
The action names eight individuals and two companies. At the center is Anibal Alexander Canelon Aguirre, known as "Prometheus," whom Treasury describes as the alleged engineer behind the malware. He also appears on the FBI's Ten Most Wanted Fugitives list and is accused of helping build the software used to force ATMs into dispensing cash without authorization.
Six additional individuals — Eric Gabriel Cardenas Arzola, Jose Dario Galeano Bazurto, Anthony Wuiliam Hernandez Guerrero, Carlos Javier Martinez Armenta, Oscar Leonardo Martinez Pirona, and Alejandro Mejia Castillo — were each linked to one of the designated cryptocurrency deposit addresses. An eighth designee, Ashy Javier Galeano Bazurto, faces separate federal charges in Nebraska for material support to Tren de Aragua, bank fraud conspiracy, bank burglary conspiracy, and money laundering conspiracy. All defendants are presumed innocent until proven guilty.
Two companies were also sanctioned — Enigma Community, S. de R.L. de C.V., and Soluciones Integrales Toluca, S.A. de C.V. — each owned by one of the designated individuals. Separately, Treasury designated Juan Gabriel Rivas Nunez, known as "Juancho," over unrelated alleged criminal activity.
The designation follows earlier action against Tren de Aragua's hacking and jackpotting operations: the Justice Department has indicted 98 people in connected schemes since late 2025.
Following the money
Blockchain analytics firm TRM Labs found that all seven sanctioned addresses function as deposit addresses at a single centralized exchange. Most had been inactive for months before the latest incoming transaction, and the address tied to Cardenas Arzola received the largest share — roughly $2.1 million.
TRM cautioned that the combined $6.1 million in tracked inflows shouldn't be treated as confirmed jackpotting proceeds, since not all incoming funds necessarily relate to the ATM scheme. The designated addresses also forwarded funds to other wallets associated with Tren de Aragua, which then moved roughly $35 million to a network tied to Jorge Figueira — who faces allegations of laundering close to $1 billion and has not been convicted.
Why it matters
Sanctions designations block the property and interests of named individuals and entities that fall under U.S. jurisdiction, and they carry reporting obligations and transaction restrictions for anyone touching the flagged assets. Because the exchange hosting these deposit addresses can identify underlying account holders, related accounts tied to the network may surface as the investigation widens.
Foreign financial institutions and exchanges face a real exposure here: knowingly facilitating significant transactions for sanctioned persons can trigger secondary sanctions, even without a direct U.S. nexus.
What to do
- Screen the seven designated TRON addresses (and any wallets linked to the named individuals and companies) against your transaction-monitoring and sanctions-screening lists.
- Review historical transaction activity for indirect exposure — TRM recommends checking counterparties one or two hops away from the sanctioned addresses, not just direct matches.
- If you operate or support ATM infrastructure, treat this as a reminder to validate jackpotting defenses: firmware integrity checks, cash-dispenser authentication, and anomaly alerting on off-hours withdrawal patterns.
- Flag any identified connections to compliance and legal teams promptly — institutions with foreign counterparties should assess secondary sanctions exposure before processing related transactions.