The U.S. Treasury has sanctioned a network it says used cryptocurrency as one part of a broader operation to launder cash stolen from ATMs. The September 30 action targeted 10 people and companies involved in a Tren de Aragua fraud scheme, according to the Office of Foreign Assets Control.
The underlying conduct matters more than the payment rail. Treasury described crews breaking into ATMs or interactive teller machines, installing malware and remotely forcing the equipment to dispense cash without debiting an account. The agency says proceeds were then moved among members and associates to conceal where the money came from, with cryptocurrency transactions among the laundering methods.
What the sanctions action establishes
OFAC identified Anibal Alexander Canelon Aguirre, also known as “Prometheus,” as the alleged organizer and malware engineer. The Treasury release says he and six named associates indicted in Nebraska used cryptocurrency transactions to launder or facilitate the laundering of jackpotting proceeds. Another indicted individual was also included in the action.
Two Mexico-based companies—Enigma Community and Soluciones Integrales Toluca—were designated because Treasury tied their ownership or control to members of the network. The designations were made under executive orders addressing transnational criminal organizations and terrorism. They are administrative sanctions; references to indictments remain allegations unless proved in court.
Treasury reported $40.73 million in losses across more than 1,500 alleged U.S. ATM jackpotting attacks as of August 2025. That figure covers reported losses from the attack pattern, not a calculation of cryptocurrency volume. The release does not assign a dollar value to the digital-asset transfers, so it would be misleading to treat the entire loss total as onchain laundering.
Wallet addresses are compliance identifiers, not a complete map
The sanctions records include digital-currency addresses associated with designated people. Their publication gives exchanges, custodians and analytics teams concrete identifiers to screen, but an address list is not necessarily a full account of a network’s activity. Transactions still need to be evaluated alongside ownership, control and sanctions rules.
The practical effect is broader than flagging specific wallets. OFAC says property and interests in property of blocked people that are in the United States, or under the possession or control of U.S. persons, must be blocked and reported. Entities owned 50 percent or more, directly or indirectly and in aggregate, by blocked people are also blocked even if not separately named.
The narrow lesson for crypto businesses
This case does not show that cryptocurrency created the ATM attacks. Treasury’s account starts with malware, physical access and stolen cash, then follows laundering through multiple methods. For digital-asset firms, the relevant task is to screen listed identifiers without assuming that wallet screening alone resolves the wider ownership and counterparty risk.
That distinction keeps the compliance response tied to the official action: named targets, stated legal authorities and blocking rules. It also avoids turning a mixed cash-and-crypto scheme into a claim that every loss moved through a blockchain.
Adapted from OFAC Sanctions Tren de Aragua Network Laundering ATM Heist Funds via Crypto.