The U.S. Treasury's Office of Foreign Assets Control sanctioned 10 people and businesses on Sept. 30, 2026, tied to an alleged Tren de Aragua ATM-theft network, and added seven Tron addresses to its Specially Designated Nationals list.

Treasury said the network stole millions of dollars from U.S. financial institutions, citing reported U.S. ATM "jackpotting" losses of $40.73 million across more than 1,500 attacks as of August 2025.

The seven on-chain identifiers, each labeled "Digital Currency Address - TRX" in OFAC's notice, are deposit addresses at a major crypto exchange, according to blockchain analytics firm Chainalysis. The firm traced the wallets' counterparties and found exposure to shared laundering networks used by Mexican and Colombian drug cartels and Venezuelan launderers.

"The on-chain insights show us that criminal organizations are leveraging common infrastructure for laundering," Chainalysis Senior Intelligence Analyst Kaitlin Martin said in the firm's public analysis.

The ATM-related designations cover eight individuals and two Mexico-based companies. Treasury separately sanctioned Juan Gabriel Rivas Nunez, described as a senior TdA leader involved in illicit gold mining.

The most prominent name on the list is Anibal Alexander Canelon Aguirre, known as "Prometheus." The FBI added him to its Ten Most Wanted Fugitives list in March. Treasury alleges he engineered the malware used in the attacks and used cryptocurrency to launder the proceeds.

In jackpotting attacks, criminals physically access cash machines, install malware and activate it remotely to force cash withdrawals without debiting an account. Treasury said the targeted network, based in Mexico and Venezuela, laundered the stolen funds and transferred them to TdA members in multiple countries.

Stablecoin Routes and Dormant Wallets

Chainalysis investigators said the laundering networks tied to the sanctioned wallets relied heavily on stablecoins to move criminal proceeds internationally. The firm also noted that Tether had previously frozen USDT balances on several wallets with exposure to the newly sanctioned addresses.

TRM Labs, in its own analysis, said the seven listed addresses had received approximately $6.1 million in total inflows since March 2022. The firm cautioned that not all of that value was necessarily tied to the jackpotting scheme. Most of the addresses had been dormant for months, with the latest inflow occurring in July 2026.

Listed Addresses

OFAC's notice associates each address with a designated individual:

• Anibal Alexander Canelon Aguirre: TJjRAn9kLiyh8h6gjBjaYjkfDkskgZfyW9
• Eric Gabriel Cardenas Arzola: TCUmMCHQEbFFdGvfdg2LeS64QfzUKP2AgW
• Jose Dario Galeano Bazurto: THwbVuBBb26abe5TrAsYUpYz9mhWnBppdz
• Anthony Wuiliam Hernandez Guerrero: TBEmt7kPSwAv6NJTYKNdBVW524bUfPwJpJ
• Carlos Javier Martinez Armenta: TCifMAMwst3oEJx8GaNfqZw75dkFUa8vjG
• Oscar Leonardo Martinez Pirona: TDxZ1XTZCmqkJJW2eJT362z6omRchJyGBX
• Alejandro Mejia Castillo: TWJmTGhquvdp1jhBmgeGxBBwefteGZUQYW

The sanctions block the designated parties' property in the United States or under U.S. persons' possession or control. Unless licensed or exempt, U.S. persons are generally prohibited from transactions involving that property, Treasury said.

For exchanges and virtual asset service providers, the designations create immediate compliance obligations: screening against the new Tron addresses, freezing linked accounts and filing reports within regulatory timelines. With most of the listed wallets dormant since mid-2026 and Tether already acting on connected balances, enforcement attention is likely to shift to the off-ramp and exchange infrastructure that processed the funds.