Criminal gangs breached more than 1,500 ATMs across the United States over recent years, racking up losses of up to $40.73 million as of August 2025. The perpetrators exploited device vulnerabilities and installed specialized malware. Known as ATM jackpotting, the practice forces machines to dispense cash without debiting any bank accounts.
The US Department of the Treasury (OFAC) linked the hacking campaign to the Tren de Aragua criminal gang. Tracing the money trail led authorities to the crypto space, culminating in sanctions against seven TRON addresses. According to a report by TRM Labs, the seven digital wallets recorded total inflows of $6.1 million since March 2022. The analytics firm noted that not all of the funds stemmed exclusively from ATM crimes.
Exchange Deposit Addresses, Not Private Wallets
None of the TRON addresses blacklisted by OFAC were self-custody wallets. All seven operated as deposit wallets hosted on centralized crypto exchange infrastructure. The largest recipient wallet was linked to Eric Gabriel Cardenas Arzola, which took in $2.1 million in inflows.
The perpetrators moved crypto funds from the seven initial addresses to other wallets affiliated with Tren de Aragua. The transaction chain continued as roughly $35 million flowed into a network connected to Jorge Figueira. Law enforcement authorities have charged Figueira with laundering $1 billion in illicit funds, though the allegations have not yet been proven in court.
Beyond the seven TRON wallets, OFAC sanctioned eight individuals and two corporate entities operating in Mexico. The primary target was Anibal Alexander Canelon Aguirre, who went by the alias ‘Prometheus’. He is strongly suspected of developing the ATM-hacking malware.
Multi-Agency Enforcement Action
Since October 21, 2025, the US Department of Justice (DOJ) has charged 98 individuals for various roles in the jackpotting scheme. Blockchain tracing has provided law enforcement with a critical avenue to hunt down the facilitators behind these crimes.
Freezing illicit assets is nothing new within the TRON ecosystem. Last September, stablecoin issuer Tether froze $39.3 million worth of USDT across ten TRON addresses identified as part of the Xinbi Guarantee network.
In response to OFAC’s sanctions, blockchain analytics firm TRM Labs urged virtual asset service providers (VASPs) and traditional financial institutions to immediately screen these seven new TRON addresses. Service providers must also inspect transaction histories to detect any illicit inflows entering their systems.
While stolen cash vanishes from the radar the moment it leaves an ATM, laundering it through the blockchain leaves a permanent audit trail for law enforcement. The Tren de Aragua case demonstrates that the public ledger records every move criminals make.
Source: crypto.news.
Also read: Bitget Hacker Stashes Loot in Zcash Private Pool - NEAR Freezes $50M, THORChain Washes Hands
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
