Weather 
FIRST ON FOX: The Treasury Department is dropping the hammer on a Tren de Aragua (TdA) $40-plus million fraud scheme accused of using U.S. automated teller machines as a narco-terror piggybank, stealing Americans’ cash to fund its transnational terror network.
Treasury, in a First on Fox exclusive Wednesday, unleashed a whole-of-government crackdown, targeting the financial network of the violent foreign terrorist organization (FTO) TdA over a massive, high-tech ATM “jackpotting” scheme that has siphoned millions from American banks.
“President Trump’s administration will not allow terrorist organizations like Tren de Aragua to exploit the U.S. financial system or enrich themselves through theft and other criminal activity targeting American individuals and businesses,” Secretary of the Treasury Scott Bessent wrote in a statement.
“Working alongside our law enforcement partners, we will continue to use all tools available to deny these terrorist financial facilitators the resources they need to operate, weakening their overall criminal enterprise and protecting the integrity of the U.S. economy.”
META REMOVES FACEBOOK GROUP ACCUSED OF HARASSING ICE AGENTS AFTER DOJ PRESSURE
Federal data shows that reported losses from U.S. ATM jackpotting attacks totaled $40.73 million across more than 1,500 incidents through August 2025. The illicit proceeds are routinely laundered through complex cryptocurrency networks and funneled back to TdA leadership.
The Office of Foreign Assets Control (OFAC) designated 10 key targets tied to the criminal network, which relies heavily on custom malware to force automated teller machines across the United States to dispense cash on command.
According to Treasury officials, the sprawling cyberfraud operation has fueled a broader violent enterprise — spanning drug trafficking, human smuggling, and murder-for-hire — making the destruction of TdA’s financial infrastructure a top national security priority.
At the center of the targeted network is an FBI Top Ten Most Wanted fugitive: Anibal Alexander Canelon Aguirre, widely known by the alias “Prometheus.” Operating out of Mexico and Venezuela, Prometheus is accused of engineering the malicious software used to bypass physical and digital ATM security systems. Once deployed by criminal crews, the malware forces victim machines to empty their cash vaults until they run dry.
MOST INFAMOUS CRYPTOCURRENCY FRAUD SCHEMES OF ALL TIME
Since October 2025, the Department of Justice has indicted 98 individuals for their roles in the cross-country ATM jackpotting conspiracy, tying the defendants directly to TdA operations.
Alongside Prometheus, OFAC sanctioned several key associates and front companies — including Mexico-based businesses Enigma Community, S. de R.L. de C.V. and Soluciones Integrales Toluca, S.A. de C.V. — as well as high-ranking TdA gold-mining facilitator Juan Gabriel Rivas Nunez (aka “Juancho”).
The sweeping action is the result of a coordinated investigation by the Homeland Security Task Force (HSTF), involving the FBI, Homeland Security Investigations (HSI), the Financial Crimes Enforcement Network (FinCEN), and the Department of Justice’s Joint Task Force Vulcan (JTFV).
The Trump administration’s investigative actions quoted former President Barack Obama’s Executive Order 13581 on blocking property of transnational criminal organizations and former President George W. Bush’s E.O. 13224 on terrorist designations. President Donald Trump designated TdA as a Foreign Terrorist Organization (FTO) in February 2025, shortly after taking office for his second term.
HACKER SENTENCED OVER BITCOIN THEFT WORTH BILLIONS
“TdA engages in a range of criminal activities, including drug trafficking, immigrant smuggling and human trafficking, extortion, sexual exploitation of women and children, money laundering, and murder-for-hire, among others,” Treasury wrote in a press memo shared exclusively with FOX Business before its public release.
Also implicated as associates indicted in the TdA ATM jackpotting scheme are: Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, and Anthony Wuiliam Hernandez Guerrero.
They have been charged with providing material support to TdA, bank fraud conspiracy, bank burglary conspiracy, and/or money laundering conspiracy, using cryptocurrency transactions to facilitate the scheme.
