1. What Treasury did on 30 September
On 30 September 2026 the Treasury's Office of Foreign Assets Control (OFAC) designated ten targets that it describes as the financial network behind Tren de Aragua's ATM "jackpotting" scheme. It added an eleventh, Juan Gabriel Rivas Nunez, alias "Juancho", whom it calls a high-ranking leader who reportedly operates out of several South American countries and directs operations including gold mining, narcotics exports and violent crime.
All eleven were designated under Executive Order 13581, which targets transnational criminal organisations, and Executive Order 13224, the main US counter-terrorism sanctions authority. US persons must block any of their property and report it to OFAC.
At the centre is Anibal Alexander Canelon Aguirre, a 50-year-old Venezuelan listed by OFAC under the aliases "Prometheus" and "The Engineer". Treasury says he leads the operation and is the alleged engineer of its malware. He was on the FBI's Ten Most Wanted list and is indicted in the District of Nebraska.
Seven associates were designated with him: four Venezuelans (Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona and Aslhy Javier Galeano Basurto), two Mexicans (Carlos Javier Martinez Armenta and Alejandro Mejia Castillo) and Anthony Wuiliam Hernandez Guerrero, a Colombian listed as located in Mexico. Two Mexican companies were added: Enigma Community, S. de R.L. de C.V., of Tlalnepantla de Baz, linked to Martinez Pirona, and Soluciones Integrales Toluca, S.A. de C.V., of Toluca, linked to Mejia Castillo.
Treasury draws two lines to the gang's top. It says Martinez Armenta transacted directly with Hector Rusthenford Guerrero Flores, known as Niño Guerrero, whom it calls "the now deceased head of TdA", and that Martinez Pirona transacted with Jimena Romina Araya Navarro, a Venezuelan entertainer sanctioned in December 2025. It also says Aslhy Javier Galeano Basurto was detained in the United States in 2017 on suspicion of manipulating ATMs.
The novelty is in the identifiers. OFAC attached seven digital currency addresses, all on TRON, one each to Canelon Aguirre and six associates. The OFAC notices for the four earlier Treasury actions against the gang, which Le Détroit reviewed, list no digital currency addresses.
2. "Prometheus" and the jackpotting business
Jackpotting uses malware to force an ATM to dispense cash without authorisation. According to the Nebraska prosecutors, crews travelled in groups to banks and credit unions, checked each machine's security, gained physical access and installed a variant of the Ploutus malware, which was designed to delete evidence of its presence. Proceeds were allegedly split in predetermined shares and moved among members to hide their origin.
Treasury puts reported US losses from alleged jackpotting attacks at $40.73m across more than 1,500 attacks, as of August 2025. The FBI says Canelon Aguirre and others have allegedly used the technique since at least January 2024, sending crews into the United States, and Treasury says the Prometheus network itself is based in Mexico and Venezuela.
That is a prosecutor's assessment, not a finding tested at trial, and no public document puts a figure on the gang's total income. But it explains why Washington now treats a series of break-ins at Midwestern credit unions as terrorist financing.
The case began small. Police in Lincoln, Nebraska, arrested two Venezuelan nationals at the scene of a jackpotting in October 2024. Both pleaded guilty, were sentenced in June 2026 to 78 months in prison and were ordered to pay $1,537,696 in restitution. Since 21 October 2025, Treasury says, the Justice Department has indicted 98 people in jackpotting schemes, on charges that include material support to terrorists, bank fraud, bank burglary and money laundering. On 2 October 2026 the department put the number charged in the District of Nebraska at 120, and said the conspiracy had targeted or carried out attacks in 47 states, the District of Columbia and several foreign nations.
In March 2026 the FBI added Canelon Aguirre to its Ten Most Wanted list, offering up to $1m for information leading to his arrest; FBI Director Kash Patel has called him "the first ever Cyber fugitive". A warrant issued on 9 December 2025 covers four conspiracy counts: bank fraud, bank burglary and fraud in connection with computers, money laundering, and material support to terrorists. The bank fraud count alone carries up to 30 years.
He is no longer at large. Bloomberg reported that he was detained in Venezuela in the days before 15 September, citing a disclosure by Patel to a Senate committee. On 2 October he appeared before a magistrate judge in Nebraska and pleaded not guilty to all four counts, the Justice Department said, and he remains detained pending trial. The Treasury designation of 30 September therefore came after his detention. The charges are allegations that have not been tested at trial.
3. From cash to stablecoins
Jackpotting produces banknotes. Treasury says the proceeds are moved among members and associates to conceal their origin and that, among other methods, "Prometheus uses cryptocurrency transactions to launder proceeds of ATM jackpotting attacks." The release gives no figures for those flows.
Chainalysis, a blockchain analytics firm, published its own analysis the same day. It says the seven addresses "are deposit addresses at a major crypto exchange", which it does not name. That detail matters. A deposit address belongs to a customer account, so a regulated company may hold identity records for whoever opened it.
Chainalysis says its investigators analysed the network around the sanctioned wallets and found counterparties with exposure to known laundering operations in Mexico, Colombia and Venezuela, used by drug traffickers, smugglers and others. It says these included exposure to a Venezuelan national charged with laundering about $1bn and to a laundering network used by Colombian and Mexican cartels. Its post gives no volumes and no detailed method.
Chainalysis links the $1bn reference to a public case. In January 2026 prosecutors in the Eastern District of Virginia announced a criminal complaint against Jorge Figueira, a 59-year-old Venezuelan, with conspiracy to launder money. They allege that more than $1bn moved through an identified crypto wallet and various accounts, with funds converted to crypto, passed to liquidity providers and paid out in dollars, including to recipients in Colombia, China, Panama and Mexico. The Justice Department release does not mention Tren de Aragua, and Figueira is presumed innocent. A second analytics firm, TRM Labs, points the same way: it says the sanctioned addresses sent funds to other addresses associated with the gang, which in turn sent about $35m to a network that US authorities have affiliated with Figueira. Neither firm has published the underlying transactions.
Chainalysis adds that these networks "heavily use stablecoins", and that Tether, the issuer of the USDT dollar token, "previously froze USDT balances on several wallets with exposure to the addresses sanctioned today." Neither company has published the dates or amounts of those freezes.
4. What the public ledger shows
Because TRON is a public blockchain, anyone can read the history of the seven addresses. On 9 October Le Détroit queried TronGrid, a public TRON data service, for transfers of USDT, which is the main asset that passed through them. What follows is our own analysis, not an official finding.
Together the seven addresses received about $6.08m in USDT through 1,456 incoming transfers between March 2022 and July 2026. TRM Labs, working separately, puts total inflows at about $6.1m since March 2022, with about $2.1m at the Cardenas Arzola address and the latest inflow in July 2026. The largest totals sit with the addresses OFAC attributes to Cardenas Arzola (about $2.12m), Jose Dario Galeano Bazurto ($1.35m) and Mejia Castillo ($1.31m). The address attributed to Canelon Aguirre received about $224,000.
The pattern fits Chainalysis's description. Nearly every outgoing transfer we checked went to one of two addresses, consistent with an exchange sweeping customer deposits into central wallets. TRM says each address received funds from many sources. Balances are now negligible: one address holds 20 USDT, and the rest hold no USDT, only small amounts of TRX, the network's fee token, and a few other tokens.
Timing is the striking part. The last substantive USDT activity on five of the addresses dates from May to October 2025. A sixth stopped on 3 January 2026, and the seventh has received only small transfers since May 2026. The sanctions came months after most of the money had passed through.
Three caveats apply. Not every dollar sent to an exchange deposit address is necessarily criminal. We counted only USDT on TRON, not other tokens or chains. And the $6.08m cannot be set directly against the $40.73m in reported losses: stolen cash can be spent, smuggled or laundered in other ways. What the ledger does show is that the network relied on mainstream infrastructure: a large exchange and the most widely used dollar stablecoin.
5. How Tren de Aragua makes its money
Tren de Aragua began as a prison gang in Aragua state, Venezuela, and has spread across the Western Hemisphere, according to Treasury. When it sanctioned the group in July 2024, Treasury listed illegal mining, kidnapping, human trafficking, extortion and drug trafficking as revenue sources, along with the sex trafficking of migrant women and girls, and said the group had laundered funds through cryptocurrency.
The December 2025 indictment in the Southern District of Texas adds detail, all of it alleged. Leaders charge lower-level members and others a "causa" fee to work in their areas, and those who do not pay are threatened, beaten or murdered. The group smuggles gold and cocaine and sends proceeds back to members in Venezuela. Rivas Nunez, sanctioned on 30 September, is a defendant in that case; prosecutors described him as a fugitive in December 2025.
Laundering has also run through ordinary businesses. In December 2025 Treasury sanctioned a network around Araya Navarro, a DJ known as "Rosita". It said her former manager organised parties used to sell narcotics for the gang and laundered the proceeds, and that a financial leader known as "El Flipper" ran shell businesses and illegal rentals in seven countries, including the United States.
6. The terrorism label and what it changes
On 20 February 2025 the State Department designated Tren de Aragua a Foreign Terrorist Organization, alongside MS-13 and six Mexican cartels, under section 219 of the Immigration and Nationality Act. The notice was signed by Secretary of State Marco Rubio. The group was also named a Specially Designated Global Terrorist. Treasury had sanctioned it as a transnational criminal organisation on 11 July 2024.
The label changes the legal toolkit. Because providing material support to a designated organisation is a federal crime, defendants in the second Nebraska indictment face a terrorism-related count alongside bank fraud, with maximum penalties that prosecutors put at 20 to 335 years. For banks and exchanges, every new designation adds names and identifiers that compliance systems must screen and block.
The premise behind the designation is disputed. A 2025 US National Intelligence Council assessment found that Venezuela's government does not direct Tren de Aragua. Rubio rejected it, saying "They're wrong", according to CBS News.
7. Washington and Caracas in 2026
The political backdrop has changed completely. On 3 January 2026 US forces struck Venezuela and captured Nicolás Maduro and his wife, Cilia Flores, who were brought to New York. On 5 January Maduro pleaded not guilty before Judge Alvin Hellerstein to narco-terrorism, cocaine importation and weapons charges. Delcy Rodríguez, his vice-president, became acting president.
Relations then thawed fast. The US embassy in Caracas resumed operations after a seven-year closure, and on 1 April OFAC removed Rodríguez from its sanctions list, according to Al Jazeera.
Cooperation now extends to Tren de Aragua. On 12 June President Donald Trump announced that US Southern Command had killed Niño Guerrero in a "swift and lethal kinetic strike". Venezuela's communications ministry said he died in a "combined operation" of US forces and Venezuelan security services in Bolívar state, according to CBS News. The State Department had offered up to $5m since July 2025 for information leading to his arrest or conviction. Treasury's 30 September release describes him as deceased. Cooperation has since reached the ATM case: Canelon Aguirre was detained in Venezuela and sent to the United States.
Bloomberg noted that Venezuela's constitution bars the extradition of its citizens and that the Justice Department did not describe the transfer as an extradition.
8. What blockchain analytics can and cannot do
The case shows the strengths. A dollar stablecoin on a public chain combines a transparent ledger with a central issuer: Tether can freeze balances, exchanges hold customer records and analytics firms can map counterparties. TRM Labs estimates that nearly 95% of inflows to sanctioned entities and jurisdictions in 2025 went through stablecoins, and that illicit crypto volume reached a record $158bn that year, a figure it calls a conservative baseline.
Chainalysis, using its own measure of laundering, estimates that crypto money laundering grew from $10bn in 2020 to more than $82bn in 2025. The two firms use different definitions and methods, so their figures should not be compared directly.
The case also shows the limits. The listed addresses now hold almost nothing, and most had gone quiet months before they were designated, as both our count and TRM's show. The laundering counterparties Chainalysis describes sit in Mexico, Colombia and Venezuela, outside direct US reach. And the crime starts with cash pulled from machines, which leaves no trace on any chain until someone converts it.
