OFAC Sanctions Tren de Aragua Fugitive Who Laundered ATM Heists With Crypto

What it is

Chainalysis's on-chain analysis of the September 30, 2026 OFAC designation of Aguirre ("Prometheus") and six named associates (Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, Anthony Wuiliam Hernandez Guerrero). The summary has the money figures, the malware, and the laundering-infrastructure finding; what it omits is the physical intrusion procedure and the nature of the sanctioned addresses.

How it works

The jackpotting attack was not remote — it required physical entry into each machine, split across three specialized crews:

1. Recon crew — photographs the target ATM and checks for silent hood alarms.
2. Install crew — physically breaks in, removes the hard drive, writes Ploutus onto it via a Raspberry Pi, reinserts the drive. The malware self-deletes after dispensing to defeat forensics.
3. Collection crew — receives the remote dispense command and empties the cash.

The crews were deployed into the U.S. from a network based in Mexico and Venezuela.

Preconditions / Affected

Affects ATMs where an attacker can gain physical access to the internal hard drive without triggering a silent hood alarm. The detection signal Chainalysis emphasizes is on-chain: the laundering leans on stablecoins, which gives issuers real-time freeze capability — Tether has already frozen USDT balances on wallets with exposure to these addresses.

What to do

• Screen against the seven sanctioned crypto addresses. Per the page these are deposit addresses at a major crypto exchange, not self-hosted wallets — meaning exposure surfaces through counterparty/exchange-flow analysis rather than direct wallet ownership.
• For a maintained, machine-readable list of OFAC-designated entities with identified crypto addresses, use Chainalysis's OFAC sanctions tracker (linked from the post).
• Pivot on counterparties: the designated wallets show exposure to laundering rails shared with Colombian/Mexican cartels and a Venezuelan national charged in a $1B laundering case — treat overlap with those networks as an indirect exposure indicator.

Caveats

The underlying charges rest on a December 2025 indictment; the $40.73M / 1,500+ attacks figure is "reported losses as of August 2025," i.e., alleged, not adjudicated. Chainalysis does not name the exchange holding the deposit addresses, nor the specific chains involved beyond the general stablecoin observation.