Treasury sanctions 10 over Ploutus ATM jackpotting it ties to Tren de Aragua
Treasury's OFAC sanctioned 10 people over Ploutus ATM jackpotting, a scheme US officials tie to at least 1,500 attacks and $40.7 million in losses. Treasury calls the thefts a key revenue source for the Venezuelan criminal group Tren de Aragua.
The Watch · Security desk
What happened
- OFAC's designations cover several Venezuelan nationals and companies they control, all part of the effort to launder cash stolen from dozens of ATMs.
- The proceeds allegedly went to Tren de Aragua members who hid their origin through cryptocurrency or through companies they own in Mexico and other countries.
- The FBI has named Anibal Alexander Canelon Aguirre, now on its most wanted list, as the developer of the Ploutus malware.
- Treasury says it has photographs of Aguirre with proceeds of the jackpotting crimes.
- At least 98 people have been indicted in the scheme, and five men pleaded guilty to related charges last month.
Why it matters
- What doesn't add up contradiction Anyone treating this as a Tren de Aragua threat is relying on a government attribution that outside researchers have not corroborated.
- Who's exposed exposure Exchanges and firms that move money for the designated Venezuelans or the companies they control are now handling funds of OFAC-listed parties.
- What's now possible capability Tracing jackpotting cash gives investigators a route into stablecoin laundering services that, per Chainalysis, also serve other Latin American criminal groups.
- What it costs cost Because the malware empties the machine, each successful hit costs the operator whatever cash that ATM was holding.
Ploutus needs physical access and a laptop. In videos and photos released by prosecutors and Treasury, men crack open the top of an ATM, link a laptop to it and install the malware [9]. The malware then forces the machine to dispense all of its available cash [10]. Aguirre is accused of sending multiple teams across the US to use it on ATMs typically located in remote areas [6].
The tool is mature. Experts and government agencies have warned about Ploutus variants for nearly a decade [15]. Google researchers called it "one of the most advanced ATM malware families" they had seen [16].
Across the tracked incidents, the loss averages about $27,000 per attack, or $40.7 million divided by 1,500 [17]. Both figures cover only the attacks US officials have tracked, and the attack count is a floor [2]. The Record's report does not describe any new requirement for banks or ATM operators [14].
Wednesday's designations target the laundering operation [1][3]. Chainalysis said jackpotting proceeds "flow through the same channels as drug trafficking money" [11]. The firm found that counterparties of the Tren de Aragua wallets had exposure to laundering operations used by Colombian and Mexican drug cartels, "as well as a Venezuelan national charged with laundering one billion dollars" [12]. "The network relied on shared laundering infrastructure, including stablecoins, that services multiple criminal organizations across Latin America," Chainalysis said [13].
The Justice Department has repeatedly claimed "extensive direct and indirect links" between Ploutus and Tren de Aragua [19]. Experts have not found any links between Ploutus and either Aguirre or the gang, The Record reported [20].
What to watch
- Technical evidence, from researchers or in court filings, that connects Ploutus samples to Aguirre or Tren de Aragua.
- Whether Aguirre is arrested and whether the 98 indictments go to trial with evidence on the laundering routes.
- Further OFAC designations aimed at the stablecoin laundering services Chainalysis says the network shared with cartels.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+20
- Incentives55
- Confidence68
Perspective Coverage
5 publishers- Builder
- Builder 19%
- Operator
- Operator 56%
- Investor
- Investor 25%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Treasury Department's Office of Foreign Assets Control sanctioned 10 people on Wednesday for their role in a scheme using malware that allowed people to drain ATMs of their cash.
- [2]
U.S. officials have tracked at least 1,500 of the attacks causing $40.7 million in losses.
- [3]
OFAC targeted multiple Venezuelan nationals and several companies they control that are part of the effort to launder the money stolen from dozens of ATMs.
- [4]
The proceeds of ATM thefts were allegedly transferred to Tren de Aragua members who helped conceal their origin, either through cryptocurrency or by laundering the funds through companies they own in Mexico and other countries.
- [5]
FBI officials previously claimed the developer of the Ploutus malware is Anibal Alexander Canelon Aguirre, who was added to the FBI's most wanted list.
- [6]
Aguirre is accused of deploying multiple teams across the U.S. to use the malware against ATMs typically located in remote areas.
- [7]
The Treasury Department said it has photographs of Aguirre with proceeds of ATM jackpotting crimes.
- [8]
The sanctions tie the ATM jackpotting scheme to Tren de Aragua, a Venezuelan criminal group, and Treasury officials claim it is a "key source of revenue for the organization."
- [9]
Prosecutors and the Treasury Department shared videos and photos of men cracking open the top of ATMs, linking a laptop to it and installing the malware.
- [10]
The Ploutus malware forces the ATM to dispense all of its available cash.
- [11]
Chainalysis said ATM jackpotting proceeds "flow through the same channels as drug trafficking money."
- [12]
"Chainalysis analysis found that counterparties of the [Tren de Aragua] wallets had exposure to laundering operations used by Colombian and Mexican drug cartels, as well as a Venezuelan national charged with laundering one billion dollars."
- [13]
"The network relied on shared laundering infrastructure, including stablecoins, that services multiple criminal organizations across Latin America."
- [14]
The Record's report on the sanctions does not describe any new requirement or guidance for banks or ATM operators.
- [15]
Experts and government agencies have warned for nearly a decade about variants of the Ploutus malware.
- [16]
Google researchers previously said Ploutus "is one of the most advanced ATM malware families" they've seen.
- [17]
Tracked losses average about $27,000 per tracked attack.
- [18]
At least 98 people have been indicted for their role in the malware scheme and five men pleaded guilty to related charges last month.
- [19]
The Justice Department has repeatedly claimed there are "extensive direct and indirect links" between the Ploutus malware and Tren de Aragua.
- [20]
Experts have not found any links between Ploutus and Aguirre or Tren de Aragua.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comUS sanctions Tren de Aragua gang members in ATM hacks crackdown
1 article · October 2, 2026
- en.sedaily.comU.S. Sanctions Latin American Gang Over $40 Million ATM Hacking Scheme
1 article · October 1, 2026
- securityweek.comTreasury Blacklists Most-Wanted ATM Malware Developer and His Network
1 article · October 1, 2026
- thehackernews.comThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories
2 articles · October 2, 2026
- therecord.mediaUS sanctions 10 over ATM malware scheme tied to Tren de Aragua
1 article · September 30, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
Entities
- TronFollow
- Tren de AraguaFollow
- Ari RedbordFollow
- TRM LabsFollow
- ChainalysisFollow
- Anibal Alexander Canelon AguirreFollow
- PloutusFollow
- US Department of JusticeFollow
- Federal Bureau of InvestigationFollow
- Office of Foreign Assets ControlFollow