The US Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned 10 entities linked to the Venezuelan criminal group Tren de Aragua (TdA). The sanctions include 7 cryptocurrency addresses associated with the group's leader, Anibal Alexander Canelon Aguirre, known as Prometheus. Aguirre is currently on the FBI’s Ten Most Wanted Fugitives list and faces federal charges in Nebraska for his role in ATM jackpotting schemes.
According to the Treasury, the TdA group utilized the Ploutus malware to force ATMs to dispense cash without debiting accounts. Reported losses from these attacks in the United States reached $40.73 million across more than 1,500 incidents as of August 2025. The State Department designated Tren de Aragua as a Foreign Terrorist Organization in February 2025.
Data from TRM Labs indicates that the 7 sanctioned crypto addresses served as deposit accounts at a centralized exchange, receiving approximately $6.1 million since March 2022. These funds were subsequently moved to wallets connected to Jorge Figueira, who is accused of laundering $1 billion. Chainalysis reports that these criminal networks frequently utilize stablecoins and share infrastructure with Colombian and Mexican cartels.
Following the OFAC action under Executive Order 13224, foreign financial institutions that process significant transactions for these designees face the risk of secondary sanctions. Tether has already frozen USDT balances on several wallets linked to the sanctioned addresses. Analysts suggest that the centralized exchange hosting the accounts may possess the data necessary to identify the individuals behind them.
