The **U.S. Treasury Department's Office of Foreign Assets Control (OFAC)** has taken decisive action against a global ATM jackpotting network, sanctioning ten individuals and associated entities. These sanctions target Venezuelan nationals and companies they control, accused of facilitating the laundering of millions stolen from ATMs worldwide. U.S. officials have tracked approximately 1,500 such attacks, leading to an estimated $40.7 million in losses. The Treasury Department explicitly links this lucrative scheme to **Tren de Aragua**, a notorious Venezuelan criminal group, identifying it as a crucial funding stream for the organization. ### Sophisticated Laundering Operations The proceeds from these ATM thefts were allegedly funneled to **Tren de Aragua** members, who then concealed their origin through various methods. This includes extensive use of cryptocurrency and laundering funds through front companies established in Mexico and other countries. Blockchain analysis firm **Chainalysis** corroborates these findings, stating that ATM jackpotting proceeds "flow through the same channels as drug trafficking money." Their analysis revealed that wallets associated with **Tren de Aragua** had exposure to laundering operations used by Colombian and Mexican drug cartels, as well as a Venezuelan national implicated in a billion-dollar money laundering scheme. The network leverages shared laundering infrastructure, including stablecoins, to service multiple criminal organizations across Latin America. ### Ongoing Enforcement Efforts These sanctions are part of a broader U.S. government crackdown on the ATM jackpotting scheme. To date, at least 98 individuals have been indicted, and five men recently pleaded guilty to related charges. Prosecutors and the Treasury Department have shared visual evidence, including photographs and videos, depicting perpetrators connecting laptops to ATMs and installing the malware. This forces the machines to dispense all available cash. ### The Architect of Ploutus **FBI** officials have identified **Anibal Alexander Canelon Aguirre** as the alleged developer of the **Ploutus** malware. **Aguirre** has been added to the **FBI's Ten Most Wanted Fugitives** list, accused of deploying multiple teams across the U.S. to target ATMs, often in remote locations. The Treasury Department possesses photographs reportedly showing **Aguirre** with proceeds from these crimes. Several other associates cited in the recent sanctions are accused of using cryptocurrency to launder the ill-gotten funds. Variants of the **Ploutus** malware have been a concern for government agencies and cybersecurity experts for nearly a decade. **Google** researchers previously described **Ploutus** as "one of the most advanced ATM malware families" they had encountered. Despite the strong links drawn by law enforcement, experts have not publicly identified direct technical ties between the **Ploutus** malware, **Aguirre**, or **Tren de Aragua**.