US Treasury sanctions seven TRON addresses over alleged Tren de Aragua ATM scheme
OFAC added seven TRON addresses holding about $6.1 million to its sanctions list on September 30, alongside eight people and two Mexico-based companies in a Tren de Aragua ATM jackpotting case.
Why it matters
The listing lets OFAC block the addresses and bars US persons and financial institutions from dealing with them, and Crypto.News reports all seven sit at a single centralized exchange, which gives investigators a route to the accounts behind them. Beyond the wallets, the designations cut the two Mexico-based companies and the named individuals off from US business.
Where the sources disagree
Total number of designations in the Tren de Aragua action
10 targets tied to the fraud scheme, plus a high-ranking TdA leader
The Daily Hodl
Eight individuals and two Mexico-based companies, with Rivas Nunez sanctioned separately in the same action
Crypto.News, Crypto News (CryptoNews.net), TheNewsCrypto
The Daily Hodl counts 10 targets plus a high-ranking leader, while the other outlets count eight individuals and two Mexico-based companies and treat the Rivas Nunez designation as an eleventh entry, so the tally differs by one.
Key facts
OFAC added seven TRON addresses to the Specially Designated Nationals and Blocked Persons List on September 30.
Reported by The Defiant
The action designated eight individuals and two Mexico-based companies, with a separate designation for Tren de Aragua leader Juan Gabriel Rivas Nunez over illicit gold mining.
Disputed figureReported by Crypto.News
The seven TRON addresses received about $6.1 million in total inflows since March 2022, according to TRM Labs, which said not all of it is tied to the jackpotting scheme.
6,100,000 USDReported by Crypto.News
US authorities reported $40.73 million in losses across more than 1,500 alleged Tren de Aragua jackpotting attacks as of August 2025.
40,730,000 USDReported by Crypto.News
TRM Labs found all seven TRON addresses were deposit addresses hosted by one centralized exchange.
Reported by Crypto.News
Crypto.News reported that funds from the sanctioned addresses went to other Tren de Aragua wallets, with another connected network receiving about $35 million.
35,000,000 USDReported by Crypto.News
The Justice Department has indicted 98 people in ATM jackpotting schemes linked to Tren de Aragua since October 21, 2025.
98 individualsReported by TheNewsCrypto
The Daily Hodl reported that Anibal Alexander Canelon Aguirre, known as Prometheus, orchestrates the operation, and Crypto News reported Tether previously froze USDT balances on wallets exposed to the newly sanctioned addresses.
Reported by The Daily Hodl
What happened
On September 30, the US Treasury's Office of Foreign Assets Control added seven TRON addresses to its Specially Designated Nationals and Blocked Persons List, saying they were tied to an ATM jackpotting and money-laundering operation run by Tren de Aragua, which the State Department designated a Foreign Terrorist Organization on February 20, 2025. Treasury says criminals installed malware in cash machines and activated it remotely to force withdrawals without debiting a customer account, then moved the proceeds between members and associates in Mexico, Venezuela and other countries, partly through cryptocurrency. It reported $40.73 million in losses across more than 1,500 alleged jackpotting attacks as of August 2025, The Daily Hodl says 10 targets were designated plus a senior leader, and the Mexico-based companies named are Enigma Community and Soluciones Integrales Toluca. TRM Labs found the seven addresses took in about $6.1 million since March 2022 and cautioned that not all of it is tied to the scheme, adding that most addresses had been dormant for months and the latest inflow came in July 2026. Crypto.News, the only outlet in this set to report it, says all seven are deposit addresses at one centralized exchange and that another connected network received about $35 million. Chainalysis, as reported by The Defiant and Crypto News, linked counterparties of the wallets to laundering routes used by Colombian and Mexican cartels and Venezuelan launderers, and The Daily Hodl names Anibal Alexander Canelon Aguirre, an FBI Top 10 Most Wanted fugitive, as the orchestrator; what is not settled is how much of the $6.1 million came from jackpotting rather than other activity.
How the story developed
- Official statement
OFAC designates seven TRON addresses, eight individuals and two Mexico-based companies
Treasury described the malware mechanism, the Mexico- and Venezuela-based network and $40.73 million in reported losses across more than 1,500 attacks as of August 2025.
- Official statement
Juan Gabriel Rivas Nunez designated over alleged illicit gold mining
The senior Tren de Aragua leader, known as Juancho, was sanctioned in the same action.
- First report
First report by The Defiant
OFAC Sanctions Tren de Aragua ATM Network, Lists Seven Tron Addresses
- Update
The Defiant reports OFAC listed seven TRON addresses
The first account in the set describes the listing and cites Chainalysis on exposure of the wallets' counterparties to cartel-linked laundering networks.
- Update
Chainalysis says launderers relied on stablecoins and shared infrastructure
Chainalysis senior intelligence analyst Kaitlin Martin said on-chain data show criminal groups using common infrastructure to move proceeds; Crypto News also reported Tether had frozen USDT on wallets exposed to the newly sanctioned addresses.
- Independent corroboration
Independently corroborated by Crypto.News
Seven TRON addresses sanctioned over alleged Tren de Aragua ATM attacks
- Update
Crypto.News independently reports the seven addresses and the $6.1 million in inflows
The second independent account in the set adds that all seven addresses are deposit addresses at a centralized exchange and that another connected network received about $35 million.
- Update
TRM Labs analysis finds most addresses dormant with the latest inflow in July 2026
TRM Labs put total inflows since March 2022 at about $6.1 million and cautioned that not all of it relates to the alleged ATM scheme.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 30 Sept 2026, 21:29 UTC: The Defiant — 1 independent source, 1 reports
- 1 Oct 2026, 08:15 UTC: Crypto.News — 2 independent sources, 2 reports
- 1 Oct 2026, 12:03 UTC: TheNewsCrypto — 3 independent sources, 4 reports
- 1 Oct 2026, 13:15 UTC: The Daily Hodl — 4 independent sources, 5 reports
Affected entities
Also mentioned: U.S. Department of Justice, Chainlink
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| The Defiant Crypto media | OFAC Sanctions Tren de Aragua ATM Network, Lists Seven Tron Addresses | Original | |
| Crypto.News Crypto media | Seven TRON addresses sanctioned over alleged Tren de Aragua ATM attacks | Independent | |
| The Daily Hodl Crypto media | Tren de Aragua ATM Malware Network Sanctioned After $40,730,000 Stolen From U.S. Banks Across Over 1,500 Attacks | Syndicated | |
| TheNewsCrypto Crypto media | OFAC Sanctions Seven TRON Addresses Linked to Tren de Aragua ATM Scheme | Syndicated | |
| Crypto News (CryptoNews.net) Aggregator | OFAC Sanctions Tren de Aragua ATM Network, Lists Seven Tron Addresses | Syndicated |
Related events
Chainalysis says state-linked hackers drove 420% surge in malware instructions stored on public blockchains
Chainalysis found state-linked hackers used public blockchains to store malware instructions, with cases rising 420% over 12 months.
$387 million stolen from Bitget traced to North Korea-linked actors across four chains
Chainalysis traced $387 million stolen from Bitget in 23 transfers across four chains and attributed the September 24 breach to North Korea-linked actors.
Crypto activity fell 1.6% while market capitalization contracted by $2.1 trillion
Crypto economic activity fell 1.6% to $9.4 trillion through June 30, 2026, while reported market capitalization losses reached $2.1 trillion.
Drift Protocol exploiter moves 44,510 ETH to Tornado Cash over two days after six-month dormancy
Wallets linked to the April Drift exploit sent 44,510 ETH worth $109 million to Tornado Cash on October 20-21, retaining approximately 56,569 ETH.
Tether CEO disputes Senate Iran sanctions report, claims proactive freezes cut volumes 94%
Tether CEO Paolo Ardoino disputes a Senate report accusing the company of slow sanctions enforcement, claiming proactive wallet freezes reduced Iran-linked USDT volumes by 94% since 2023.
UK sanctions Cryptomus, Heleket and TokenSpot in 38-designation Russia package
The UK sanctioned three crypto platforms and two payment firms on October 8 for allegedly helping Russia evade financial sanctions, linking them to the Kremlin-backed A7 network and sanctioned exchanges Garantex and Grinex.