The US Treasury's Office of Foreign Assets Control (OFAC) sanctioned 10 targets on Wednesday, including 7 crypto addresses belonging to ringleader 'Prometheus', an FBI Most Wanted fugitive, and his associates. According to reports from Treasury, these sanctions target an ATM jackpotting scheme run by Tren de Aragua (TdA), a Venezuelan group designated as a Foreign Terrorist Organization by the State Department in February 2025. Treasury Secretary Scott Bessent stated that the administration intends to cut off the criminal group's access to the domestic banking system.
According to TRM Labs analysis, seven TRON addresses received approximately $6.1 million in total inflows since March 2022, with the largest portion going to the address attributed to Eric Gabriel Cardenas Arzola, which received approximately $2.1 million. All seven addresses were deposit accounts hosted at centralized exchanges, providing direct linkage to accounts held through virtual asset service providers rather than self-custody wallets. The most recent inflow to Cardenas Arzola's address occurred in July 2026. Reported US losses from alleged jackpotting attacks reached $40.73 million as of August 2025, spanning more than 1,500 incidents. TRM notes that not all funds necessarily tie to jackpotting operations, and the firm cautioned that the sanctioned addresses sent funds to other TdA-linked wallets, which in turn moved roughly $35 million to a network US authorities link to Jorge Figueira, a Venezuelan national facing charges of laundering about $1 billion.
The sanctioned network allegedly laundered stolen cash through cryptocurrency and other channels. As reported by Treasury, ATM fraud has become a key revenue source for TdA since its designation. Jackpotting attacks use malware to make ATMs release cash without debiting any account, with court filings in Nebraska identifying the strain as Ploutus, which was set to erase itself after each attack. Treasury identifies Prometheus as Anibal Alexander Canelon Aguirre, the alleged engineer of that malware, who sits on the FBI's Ten Most Wanted Fugitives list and faces charges in Nebraska federal court. The stolen cash was routinely converted into cryptocurrency to move the funds back to gang members operating in Mexico, Venezuela, and South America. The attacks typically involve monitoring targeted machines before malware installation and remote activation to bypass security controls, with the network operating from Mexico and Venezuela while targeting machines in the United States.
Because OFAC used Executive Order (E.O.) 13224, foreign financial institutions knowingly handling significant transactions for designees risk secondary sanctions. Under the penalties enacted Wednesday, all U.S. property, bank balances, and business interests tied to the sanctioned targets are immediately frozen, and American citizens and businesses are prohibited from dealing with them. Federal prosecutors have charged 98 people in connection with the ATM jackpotting ring since late 2025. The immediate compliance work falls on the exchange hosting the seven addresses and other virtual asset service providers that processed funds moving to or from them. TRM recommends that virtual asset service providers and financial institutions screen the seven TRON addresses and review historical transactions for exposure, extending checks to indirect counterparties because funds moved from the designated addresses to other wallets associated with TdA.
TRON's involvement in the latest sanctions action comes as the blockchain handles a large share of global USDT activity. During the second quarter, TRON processed $2.1 trillion in USDT transfers while its stablecoin market reached a record $89.2 billion. USDT supply on the blockchain ended the quarter at $87.9 billion, according to Messari data. The network has repeatedly appeared in recent sanctions cases involving USDT, including 131 TRON addresses added to OFAC's ISIS K designation in July, with Tether subsequently freezing balances across all addresses that had received more than $1.4 million since 2023. More recently, Tether said it helped freeze nearly $550 million in Iran-linked USDT during 2026, with four TRON wallets holding more than $130 million frozen in a July action tied to the Central Bank of Iran. A separate September case involved $61.2 million in USDT that U.S. prosecutors are seeking to forfeit, with court records identifying 10 TRON addresses holding the funds allegedly connected to proceeds from sanctioned Iranian oil sales.
