US Treasury sanctions seven TRON addresses tied to Tren de Aragua ATM network; Tether freezes all

The US Treasury Department's Office of Foreign Assets Control (OFAC) on Sept. 30 designated 10 targets, eight individuals and two Mexico-based companies, involved in an ATM hacking scheme run by the criminal group Tren de Aragua (TdA). OFAC added seven TRON blockchain addresses used by the designated individuals to its sanctions list, and Tether, the issuer of the USDT stablecoin, froze all seven addresses later on Sept. 30.

Malware that made ATMs spit out cash

According to Treasury, the network used a technique known as "jackpotting," installing malware on US automated teller machines (ATMs) to force them to dispense cash without debiting an account. Criminals first surveil the machines, break in to install the malware, activate it remotely to bypass security systems, and then push a dispense command until the machine runs out of cash.

Treasury said reported losses from alleged ATM jackpotting attacks in the United States totaled $40.73 million across more than 1,500 attacks as of August 2025. The proceeds were transferred among TdA members and associates to conceal their illicit origins, and cryptocurrency transactions were used in the process, Treasury said. The Justice Department has indicted 98 people in connection with ATM jackpotting schemes since Oct. 21, 2025.

At the center of the action is Anibal Alexander Canelon Aguirre, known as "Prometheus." Treasury identified him as the alleged engineer of the malware used in the attacks. He is on the FBI's Ten Most Wanted Fugitives list. Six of his associates have been indicted in the US District Court for the District of Nebraska on charges including providing material support to TdA and bank fraud conspiracy. Two Mexico-based companies owned by two of them were also designated.

"President Trump's administration will not allow terrorist organizations like Tren de Aragua to exploit the U.S. financial system or enrich themselves through theft and other criminal activity targeting American individuals and businesses."

Scott Bessent, US Treasury Secretary

From sanctions list to frozen addresses

Tren de Aragua had already been designated a terrorist organization by the US government. The steps leading to this action are as follows.

1. July 11, 2024OFAC sanctions Tren de Aragua as a transnational criminal organization
2. Feb. 20, 2025US State Department designates it a Foreign Terrorist Organization (FTO)
3. June, July and Dec. 2025OFAC sanctions additional leaders and support networks
4. Sept. 30 (US time)OFAC designates 10 targets including the ATM jackpotting network and lists seven TRON addresses
5. Oct. 1, 1:14 a.m. KSTTether freezes the seven addresses one after another in the USDT contract over about 20 seconds

According to the OFAC list, each of the seven TRON addresses is attributed to Prometheus or one of six associates. TRON blockchain records show Tether added the seven addresses to the USDT blacklist, which blocks them from sending or receiving USDT. As of the afternoon of Oct. 1, six of the seven addresses held no USDT, and one held 20 USDT.

They were exchange deposit addresses

Blockchain analytics firm TRM Labs said all seven addresses are deposit addresses hosted at a centralized exchange and have received about $6.1 million in total inflows since March 2022. The address attributed to associate Eric Gabriel Cardenas Arzola received the largest share, about $2.1 million, with its most recent inflow in July 2026, TRM Labs said. Another analytics firm, Chainalysis, said "Tether previously froze USDT balances on several wallets with exposure to the addresses sanctioned today."

Treasury blocked all property of the designated persons in the United States and generally prohibited US persons from dealing with them. It warned that foreign financial institutions that conduct significant transactions with the designated persons could face secondary sanctions. OFAC also designated Juan Gabriel Rivas Nunez, known as "Juancho," a TdA leader who directs operations including illicit gold mining in multiple South American countries, on the same day.

USDT trades at 1,359 won in Korea

In South Korea, USDT trades on the Korean won markets of Upbit and Bithumb. As of 3:30 p.m. KST on Oct. 1, USDT was at 1,359 won on Upbit and 1,358 won on Bithumb, about 0.2% above the won-dollar conversion rate tracked by Coinyong (about 1,356 won) at the same time. TRON (TRX) traded at 459 won on Upbit.

Tether said on Sept. 28 (US time) that it had helped freeze about $550 million in Iran-linked USDT this year.