US authorities have arrested and arraigned a 50-year-old Venezuelan member of the Tren de Aragua (TdA) cartel, Anibal Alexander Canelon Aguirre, on charges related to an ATM jackpotting scheme that used Ploutus-D malware to compromise cash machines and dispense tens of thousands of dollars. The US Attorney’s Office for the District of Nebraska says he is the group’s principal architect and is alleged to have laundered proceeds through Venezuelan, Mexican, and Colombian cryptocurrency networks, including TRON.
The indictment states TdA hit cash machines in Latin America and North America, with the District of Nebraska asserting more than $5.1 million stolen from 117 banks and credit unions in the United States during 2024–2025.
Evidence cited by prosecutors and security researchers shows the group deployed the Ploutus family of ATM malware, with Ploutus-D designed to target Diebold models, enable remote cash dispensing, and delete traces. The dispute over ownership of the malware is noted, but authorities attribute development to Canelon Aguirre.
The scheme used the Kalignite multi-ATM platform to operate on machines from more than 40 vendors, and laundering relied on cryptocurrency networks to move funds to sanctioned wallets, including seven TRON addresses later designated by OFAC. U.S. authorities say the TdA run extended into money mules who convert cash to crypto, laundering proceeds through international networks; OFAC and TRM Labs have highlighted the on-chain movements and sanctions connected with the operation.