Criminals who plant malware in a bank’s cash machine can make it pay out until it is empty, and the Treasury Department now puts reported losses from that kind of attack in the United States at $40.73 million across more than 1,500 attacks. The figure is as of August 2025, and Treasury describes the attacks as alleged. It came in a Sept. 30 announcement sanctioning 10 targets linked to Tren de Aragua, the gang that the release treats as a designated foreign terrorist organization.
Treasury says Tren de Aragua, known as TdA, “has used ATM jackpotting in the United States to steal millions of dollars from financial institutions.” The release ties the $40.73 million figure to jackpotting attacks in the U.S. generally and does not say how much of it TdA is responsible for. It also does not say who reported the losses.
The money at issue is cash inside machines owned by banks and other institutions. Treasury describes a jackpotting attack as malware that makes an ATM dispense cash “without debiting an account,” and the release names no individual customer as a victim. That is the practical answer for anyone wondering whether their own balance is at risk from this scheme: the losses described belong to the institutions.
Anibal Canelon Aguirre, known as Prometheus, is on the FBI’s Ten Most Wanted Fugitives list, so an arrest or new indictment is the next development.
Get the next update the morning it lands →
How a jackpotting attack works
Treasury lays out four steps. Criminals first surveil ATMs they might target. They then break into the machines and install malware, activate it remotely so it bypasses the machine’s security systems, and send a command to dispense cash. The machine keeps paying until it runs out of cash or the operation is disrupted.
The release says TdA “deploys numerous crews to the United States” to carry this out, and that the network launders the proceeds with cryptocurrency transactions. It gives no crypto totals.
Who Treasury sanctioned
The Office of Foreign Assets Control designated 10 targets, eight individuals and two Mexico-based companies. The companies are Enigma Community, owned or controlled by Oscar Leonardo Martinez Pirona, and Soluciones Integrales Toluca, owned or controlled by Alejandro Mejia Castillo. The other individuals are Carlos Javier Martinez Armenta, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Anthony Wuiliam Hernandez Guerrero and Aslhy Javier Galeano Basurto.
The leader of the jackpotting network, Treasury says, is Anibal Alexander Canelon Aguirre, who goes by “Prometheus.” He is on the FBI’s Ten Most Wanted Fugitives list and has been indicted in the District of Nebraska, and Treasury calls him the alleged engineer of the malware. Treasury also named a higher-ranking TdA leader, Juan Gabriel Rivas Nunez, known as “Juancho,” who it says directs operations in several South American countries. He was indicted in the Southern District of Texas in December 2025.
Treasury Secretary Scott Bessent said the administration “will not allow terrorist organizations like Tren de Aragua to exploit the U.S. financial system.”
Charges, not convictions
Since Oct. 21, 2025, the Justice Department has indicted 98 people for roles in ATM jackpotting schemes, according to the release. The charges include material support to a designated foreign terrorist organization, bank burglary, money laundering, unauthorized access to protected computers and bank fraud. Maximum penalties on conviction run from 20 to 335 years in prison. An indictment is an accusation, and the release does not report any convictions in these cases.
The $40.73 million figure itself is also a count of alleged attacks, not adjudicated ones, and it is more than a year old. Treasury gives no updated total for the period since August 2025.
What a sanctions listing does
For most people, the sanctions affect banks and businesses, not households. Under the designations, all property of the 10 targets in the United States or in U.S. hands must be blocked and reported to OFAC. Companies that are 50 percent or more owned by blocked persons are blocked too, and U.S. persons generally cannot deal with them without a license. The release adds that foreign financial institutions that engage in certain transactions with persons designated under one of the two executive orders can face secondary sanctions.
Treasury’s release offers no ATM security guidance for the public. Because the losses it describes belong to institutions, and the cash comes from the machine, a customer’s account is not the target of this particular scheme, according to the release’s own description.
The Treasury announcement is the place to follow later developments, including further designations. The 98 indictments and Prometheus’s place on the FBI list are the facts most likely to change as cases move through the courts.
More Financial Reading
- 16 Steps to Stop the Scams That Took $7.7 Billion From Seniors
- 24 Ways to Stretch a $2,087 Social Security Check
- 20 Medicare Money Moves Now That Part D Caps at $2,400
This article was produced with AI assistance and edited for accuracy against the sources linked above.
