Seven TRON addresses sanctioned over alleged Tren de Aragua ATM attacks

TRON has been pulled into another U.S. sanctions action after the Treasury Department added seven addresses on the network to its sanctions list over an alleged ATM jackpotting operation tied to Tren de Aragua.

Summary

• Seven TRON addresses that received about $6.1 million were added to the U.S. sanctions list over an alleged Tren de Aragua ATM jackpotting operation.
• All seven addresses were hosted by a centralized crypto exchange, potentially allowing the underlying accounts and connected activity to be identified.
• U.S. authorities reported $40.73 million in losses across more than 1,500 alleged Tren de Aragua jackpotting attacks as of August 2025.
• Funds from the sanctioned TRON addresses were sent to other wallets associated with Tren de Aragua, with another connected network receiving about $35 million.

According to TRM Labs, the seven TRON addresses received approximately $6.1 million in total inflows since March 2022. The blockchain intelligence firm cautioned that not all of the funds were necessarily connected to the alleged ATM scheme.

The addresses were added to the Specially Designated Nationals and Blocked Persons List as the U.S. Treasury's Office of Foreign Assets Control sanctioned eight individuals and two Mexico based companies over the operation. A separate Tren de Aragua leader accused by Treasury of involvement in illicit gold mining was designated in the same action.

TRM found that all seven TRON addresses were deposit addresses hosted by a centralized crypto exchange, giving the sanctions action a direct link to accounts held through a virtual asset service provider instead of self custody wallets.

Seven TRON addresses received $6.1 million

TRM traced the largest portion of the $6.1 million to the TRON address attributed to Eric Gabriel Cardenas Arzola, which received approximately $2.1 million.

According to the firm's analysis, activity across the seven addresses followed a similar pattern. Each received funds from numerous sources through deposit addresses hosted at a centralized exchange, while most have remained dormant for months. The most recent inflow identified by TRM went to the address attributed to Cardenas Arzola in July 2026.

Funds did not stop at the seven wallets. TRM said the sanctioned addresses sent cryptocurrency to other addresses associated with Tren de Aragua. The second group of addresses subsequently sent approximately $35 million to a network that U.S. authorities have affiliated with Venezuelan national Jorge Figueira.

U.S. authorities have charged Figueira with laundering approximately $1 billion in illicit funds. According to TRM, Figueira has not been convicted and the charges against him remain allegations.

The latest findings resemble another TRON based pattern TRM identified in September. Exchange hosted deposit addresses were used in the Xinbi Guarantee network, where illicit value largely settled through USDT on TRON.

Tether subsequently froze $39.3 million in USDT across 10 TRON addresses linked to Xinbi Guarantee, crypto.news previously reported. TRM had identified Xinbi as one of Southeast Asia's largest illicit crypto marketplaces, with approximately $24.2 billion in transactions since 2022.

Treasury ties TRON wallets to alleged ATM attacks

Treasury described the operation behind the latest sanctions as an ATM jackpotting scheme, a cyberattack in which criminals exploit vulnerabilities in ATMs or interactive teller machines and install malware that forces them to dispense cash without debiting a bank account.

According to the Treasury account cited by TRM, the attacks typically involve monitoring a targeted machine before malware is installed and remotely activated to bypass its security controls. The network operates from Mexico and Venezuela while targeting machines in the United States. Stolen funds are allegedly laundered through several methods, including cryptocurrency transactions, before being sent to Tren de Aragua members in different countries.

Reported U.S. losses from alleged Tren de Aragua jackpotting attacks reached $40.73 million across more than 1,500 attacks as of August 2025, according to Treasury. Since Oct. 21, 2025, the Department of Justice has indicted 98 people over their alleged roles in ATM jackpotting schemes.

Anibal Alexander Canelon Aguirre, known as "Prometheus," was identified as the main target of the latest action. Treasury alleges Canelon Aguirre engineered the malware used in the attacks. Six alleged associates were designated alongside him, with OFAC linking each of the seven individuals to one of the TRON addresses.

The defendants face charges in the U.S. District Court for the District of Nebraska that include providing material support to Tren de Aragua, bank fraud conspiracy, bank burglary conspiracy and money laundering conspiracy. All charges remain allegations, and the defendants are presumed innocent unless proven guilty.

TRON remains prominent in stablecoin transfers

TRON's appearance in the latest sanctions action comes as the blockchain handles a large share of global USDT activity.

During the second quarter, TRON processed $2.1 trillion in USDT transfers while its stablecoin market reached a record $89.2 billion. USDT supply on the blockchain ended the quarter at $87.9 billion, according to Messari data published in August.

The network has repeatedly appeared in recent sanctions and asset freeze cases involving USDT. OFAC added 131 TRON addresses to its ISIS K designation in July, with Chainalysis saying Tether subsequently froze balances across all of the addresses. The wallets had received more than $1.4 million since 2023, while Tether froze the balances following the sanctions update.

More recently, Tether said it had helped freeze nearly $550 million in Iran linked USDT during 2026. Four TRON wallets holding more than $130 million were frozen in a July action tied to the Central Bank of Iran.

A separate September case involved $61.2 million in USDT that U.S. prosecutors are seeking to forfeit. Court records identified 10 TRON addresses holding the funds, which prosecutors alleged were connected to proceeds from sanctioned Iranian oil sales. Tether had frozen all 10 wallets.

Exchange accounts face screening after TRON sanctions

According to TRM, the latest Tren de Aragua addresses differ from self custody wallets because all seven are deposit addresses hosted at a centralized exchange. The exchange hosting the addresses may therefore be able to identify the underlying account holders and accounts connected to them.

TRM said virtual asset service providers and financial institutions should screen the seven TRON addresses and review historical transactions for exposure. Its analysis recommended extending those checks to indirect counterparties because funds moved from the designated addresses to other wallets associated with Tren de Aragua.

Since the designations were made under Executive Order 13224, foreign financial institutions that knowingly conduct or facilitate a significant transaction on behalf of a designated person may face secondary sanctions. According to the report, possible measures include restrictions involving U.S. correspondent or payable through accounts.

The immediate compliance work falls on the exchange hosting the seven addresses and other virtual asset service providers that processed funds moving to or from them, TRM said. The firm plans to continue tracking activity connected to the addresses and Tren de Aragua's financial network.