On 30 September 2026, the U.S. Treasury's Office of Foreign Assets Control (OFAC) designated a Tren de Aragua (TdA) financial network that stole millions of dollars from American banks by hacking ATMs, then laundered the proceeds through seven TRON addresses. The action came just two days after a U.S. Senate investigation named USDT on TRON as the settlement layer of choice for Iran's shadow banking network and its proxies.
Though they are unrelated illicit networks, both run on the same rails, and both are being targeted under the same counter-terrorism authority. Nominis assesses that this convergence is the story compliance teams should be paying attention to.
From ATM to wallet
The network is led by Anibal Alexander Canelon Aguirre, known as "Prometheus" and "The Engineer", who sits on the FBI's Ten Most Wanted list. Treasury describes him as the alleged author of the malicious software at the heart of the scheme, a technique known as ATM jackpotting.
Crews first survey target machines, then break into them and install malware. Once activated remotely, the software bypasses the machine's controls and forces it to dispense cash until it runs dry. According to Treasury, reported losses from alleged jackpotting attacks in the United States reached $40.73 million across more than 1,500 incidents as of August 2025. The U.S. Department of Justice has indicted 98 individuals in connection with these schemes since October 2025.
The cash does not stay in the United States. Treasury states that the network uses cryptocurrency transactions to launder the proceeds and pass them to TdA members in Mexico, Venezuela and beyond. This is the point at which a physical theft becomes a traceable on-chain flow.
Who was Designated?
OFAC designated nine individuals and two Mexico-based companies. Seven of the individuals have a TRON (TRX) address attached to their entry on the SDN List.
Anibal Alexander Canelon Aguirre ("Prometheus", "The Engineer")
Listed location: Venezuela
Wallet Address: TJjRAn9kLiyh8h6gjBjaYjkfDkskgZfyW9
Eric Gabriel Cardenas Arzola
Listed location: Venezuela
Wallet Address: TCUmMCHQEbFFdGvfdg2LeS64QfzUKP2AgW
Jose Dario Galeano Bazurto
Listed location: Venezuela
Wallet Address: THwbVuBBb26abe5TrAsYUpYz9mhWnBppdz
Anthony Wuiliam Hernandez Guerrero
Listed location: Colombia (based in Mexico)
Wallet Address: TBEmt7kPSwAv6NJTYKNdBVW524bUfPwJpJ
Carlos Javier Martinez Armenta
Listed location: Mexico
Wallet Address: TCifMAMwst3oEJx8GaNfqZw75dkFUa8vjG
Oscar Leonardo Martinez Pirona
Listed location: Venezuela
Wallet Address: TDxZ1XTZCmqkJJW2eJT362z6omRchJyGBX
Alejandro Mejia Castillo
Listed location: Mexico
Wallet Address: TWJmTGhquvdp1jhBmgeGxBBwefteGZUQYW
Aslhy Javier Galeano Basurto
Listed location: Venezuela
Wallet Address: None listed
Juan Gabriel Rivas Nunez ("Juancho", "Negro Juancho")
Listed location: Venezuela
Wallet Address: None listed
The two entities are Enigma Community, S. de R.L. de C.V., based in Tlalnepantla de Baz and owned by Martinez Pirona, and Soluciones Integrales Toluca, S.A. de C.V., owned by Mejia Castillo.
Rivas Nunez sits outside the jackpotting network. Treasury describes him as a senior TdA leader directing gold mining, narcotics exports and violent crime across several South American countries. Every designation was made under both E.O. 13581 and E.O. 13224, and each carries secondary sanctions risk for foreign financial institutions.
Why TRON
All seven addresses in this action sit on TRON, and Nominis assesses that this is no coincidence. TRON carries the largest share of USDT in circulation, transfers cost cents and settle in seconds, and the sheer volume of everyday payment activity on the network gives illicit flows a large crowd to hide in.
For TdA, those properties solve a specific problem. Its proceeds start life as physical cash taken from machines in the United States, and they need to reach members in Venezuela, Mexico and Colombia without passing through a bank. A dollar-pegged token on a cheap, fast network is the most practical way to do that, and it is widely available through exchanges and over-the-counter brokers across Latin America.
What Nominis is seeing is TRON's shift from one option among several to the default settlement layer for illicit finance. Actors with very little in common, from Latin American criminal organisations to Hamas fundraising campaigns and Iranian oil smuggling networks, have converged on the same rail for the same practical reasons.
A pattern the Senate has just documented
On 28 September 2026, the minority staff of the U.S. Senate Permanent Subcommittee on Investigations (PSI) published Tethered to Terrorism, a report on how Iran uses cryptocurrency to evade sanctions and fund its proxies. PSI analysed 846 wallets sanctioned or seized by OFAC and Israel's National Bureau for Counter Terror Financing (NBCTF), and found that 84% transacted almost entirely in USDT. The report places the shift between 2023 and 2024, when Hamas fundraising moved from Bitcoin to USDT on TRON.
TdA has no connection to that network. But it runs on the same infrastructure, and it has been designated under the same counter-terrorism authority, E.O. 13224, that OFAC uses against Iran's proxies. Read together, the two actions show a single settlement rail serving state-backed sanctions evasion and transnational organised crime alike.
The report's central lesson applies here too. Freezing a wallet at the point of designation captures only what is left in it. The brokers, exchange deposit addresses and relay wallets that move funds onward are rarely listed at all.
What this means for Compliance Teams
The seven addresses give compliance teams concrete identifiers to screen against, but a sanctions list is only a starting point. Nominis assesses that most exposure to networks like TdA's is indirect, sitting one or two hops from the designated addresses and invisible to screening that relies on list matching alone.
Exchanges, OTC desks and payment providers active in Mexico, Venezuela and Colombia should look beyond direct hits to the behaviour around them. Repeated cash-funded purchases, rapid conversion into stablecoins and onward transfers to wallets linked to previously designated TdA facilitators are all patterns worth reviewing.
The same centralisation that makes USDT attractive to these groups also makes it traceable and freezable in ways Bitcoin is not. The priority for issuers, exchanges and payment providers is to act on network-level intelligence before the designation arrives, not after.
Nominis continues to monitor TdA-linked activity on TRON and will update clients as further on-chain exposure is identified.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.
