US sanctions crime-linked crypto ATM network

TLDR

The US Treasury has sanctioned a Venezuela-linked criminal ATM network that allegedly used crypto wallets on TRON to launder stolen cash.

1. The action targets the Tren de Aragua ATM jackpotting network, designating 10 people and entities plus seven TRON addresses tied to tens of millions in thefts.
2. Criminals allegedly used malware to drain ATMs, then moved proceeds through centralized-exchange TRON deposit addresses and stablecoins like USDT into broader laundering networks.
3. The move heightens sanctions risk around specific wallets and their counterparties, pushing exchanges and banks to tighten screening of TRON and stablecoin flows.

Deep Dive

1. What Was Sanctioned

The Office of Foreign Assets Control (OFAC) sanctioned a Tren de Aragua-linked ATM network, adding 10 individuals and entities to the US sanctions list. Tren de Aragua (TdA) is a Venezuelan gang designated a Foreign Terrorist Organization in 2025.

According to Treasury, the group used ATM jackpotting malware to trigger remote cash withdrawals in the US, then converted and moved the proceeds via cryptocurrency. US losses tied to these alleged attacks reached about $40.73 million across more than 1,500 incidents by August 2025.

The sanctions also name ringleader Anibal Alexander Canelon Aguirre, known as Prometheus, who is charged in US court over the scheme, along with other associates linked to bank fraud and money laundering conspiracies.10 targets tied to an alleged ATM-jackpotting scheme

2. How Crypto And TRON Were Used

Treasurys action lists seven addresses on the TRON blockchain, which TRM Labs identifies as centralized-exchange deposit addresses, not self-hosted wallets. These seven addresses received about $6.1 million in inflows since March 2022, though not all funds are confirmed as jackpotting proceeds.seven TRON addresses received about $6.1 million

Funds from these deposit addresses reportedly flowed to other TdA-linked wallets, which then sent around $35 million to a laundering network US authorities associate with Jorge Figueira, charged with laundering roughly $1 billion. Chainalysis found the wallets counterparties had exposure to networks used by Colombian and Mexican cartels and noted a heavy reliance on stablecoins such as USDT.wallet counterparties with exposure to cartel laundering networks

This does not mean TRON itself is sanctioned, but specific addresses and their owners are. The risk centers on the wallets and flows, not the base chain.

3. Sanctions Risk And What To Watch

OFAC used Executive Order 13224, which means foreign financial institutions that knowingly handle significant transactions for designees can face secondary sanctions, including loss of US correspondent banking. TRM Labs urges exchanges and banks to screen the addresses, review historic flows and indirect counterparties, and identify the underlying account holders.

In practice, compliant exchanges are likely to freeze or block these wallets, flag related accounts, and tighten controls around TRON and stablecoin flows tied to suspicious clusters. For regular crypto users, the main impact is greater scrutiny on where funds come from and where they move, especially when interacting with centralized platforms.

Conclusion

US sanctions on the Tren de Aragua crypto-linked ATM network show how traditional malware-based theft and sophisticated on-chain laundering now intersect. The immediate impact is on the specific TRON and stablecoin wallets and their counterparties, but the broader signal is clear. Crypto venues and users operating through them are expected to treat sanctions compliance as core infrastructure, not an optional add-on, as law enforcement focuses more tightly on illicit flows across public blockchains.