TRON Addresses Sanctioned Over Alleged $6 Million Scheme

The United States Treasury Department's Office of Foreign Assets Control (OFAC) added seven TRON blockchain addresses to its Specially Designated Nationals list after tracing approximately $6.1 million in inflows to an alleged ATM jackpotting operation run by the Venezuelan gang Tren de Aragua.The designations name eight individuals and two Mexico-based companies connected to the network. The seven addresses collectively received the $6.1 million since March 2022, according to the Treasury Department. The largest single wallet, holding approximately $2.1 million in inflows, was linked to Eric Gabriel Cardenas Arzola, one of the eight individuals named in the action. OFAC also designated two Mexico-based front companies, Enigma Community and Soluciones Integrales Toluca.

How the ATM Jackpotting Scheme Operated

Tren de Aragua operatives deployed malware to compromise automated teller machines and force them to dispense cash, according to the Treasury Department. Earlier FBI statements identified the malware as a Ploutus variant. The operation was coordinated from Mexico and Venezuela, with ATM losses across the United States reaching $40.73 million from more than 1,500 individual attacks as of August 2025.The Department of Justice has indicted 98 people for related ATM jackpotting schemes since October 2025, filing charges that include bank fraud conspiracy, bank burglary conspiracy, material support to a designated terrorist organization, and money laundering conspiracy.Anibal Alexander Canelon Aguirre, who reportedly used the alias "Prometheus," was identified as the alleged malware engineer behind the Ploutus variant used in the attacks. The designated addresses sent approximately $35 million to a network US authorities have tied to Jorge Figueira, a Venezuelan national charged with laundering about $1 billion, according to TRM Labs.

TRON Wallets Under Escalating OFAC Scrutiny

The Tren de Aragua designations extend a pattern of OFAC enforcement against TRON addresses. In September 2026, OFAC added 52 TRON addresses connected to the Xinbi Guarantee marketplace on September 9, 2026.Earlier actions targeted TRON wallets tied to Hamas, the Islamic State affiliate ISIS-K, the Houthis, and Iranian sanctions evasion networks. Tether froze all 131 TRON wallets among the 134 addresses designated in the ISIS-K action, demonstrating how stablecoin issuers can enforce sanctions on-chain.Treasury Secretary Scott Bessent said in a prior Tren de Aragua enforcement action that the administration would "continue to use every tool to cut off these terrorists from the U.S. and global financial system," according to the Treasury Department. The State Department designated Tren de Aragua as a Foreign Terrorist Organization (FTO) in February 2025, citing drug trafficking, human smuggling, extortion, and murder-for-hire operations across multiple countries.

Crypto Rails Meet Traditional Financial Crime

The latest designations show how cryptocurrency can function as a settlement layer for criminal activity that begins entirely outside the blockchain. In this case, the alleged scheme started with malware-compromised ATMs and physical cash theft before proceeds were routed through TRON addresses that investigators could trace and ultimately sanction.The $6.1 million linked to the seven wallets represents only a fraction of the $40.73 million in reported ATM losses, but the designations give exchanges and stablecoin issuers identifiable on-chain targets. Combined with the broader prosecutions tied to the jackpotting network, the action illustrates how blockchain tracing, asset freezes, and traditional criminal investigations are being used alongside traditional criminal investigations against cross-border financial crime.