ANIBAL Alexander Canelon Aguirre, a Venezuelan national alleged to be a leader of Tren de Aragua’s ATM jackpotting operations and the developer of the Ploutus ATM malware, has been arrested in the United States. The US says he appeared in court on 2 October 2026 to face charges related to his role in the criminal network, after being added to the FBI’s top 10 most wanted fugitives list in March 2026—the first cybercriminal to achieve that distinction.
He was previously indicted in December 2025 alongside 21 others for bank burglary, fraud and money laundering conspiracy. The US Treasury had sanctioned him the prior week. The case centres on his alleged leadership of a long-running conspiracy that targeted ATMs across 47 states, the District of Columbia and several foreign jurisdictions, with Ploutus malware deployed to cause machines to dispense cash without debiting customer accounts.
According to US authorities, Canelon Aguirre was one of the masterminds behind the Ploutus-driven jackpotting attacks used by Tren de Aragua. The operation exploited vulnerabilities in ATMs to install the malware, which can force cash withdrawals while hiding the illicit activity; the malware reportedly included anti-analysis features and could erase itself from infected systems to impede forensic investigation.
Since the conspiracy began, 120 defendants have faced charges, with three individuals so far sentenced to prison. The arrest and ongoing detention follow a broader international and multi-defendant enforcement effort against TdA’s financial crimes.