Reported by 3 outlets
Tren de Aragua ATM jackpotting scheme used malware and crypto laundering, draws OFAC sanctions
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.50 / 2.0 · updates in 48h
- Pickup speed
- 0.58 / 0.6 · time to second source
- Recency
- × 0.37 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 1.5 / 10 = base × recency + community
Analysis
Tren de Aragua operated a multi-million dollar ATM jackpotting scheme using malware and transnational crypto laundering, drawing OFAC sanctions. Chainalysis documented how the gang used malicious software to compromise ATMs and then laundered proceeds through cryptocurrency channels across borders. The operation connects physical ATM fraud to digital asset infrastructure, making it both a banking-security and sanctions-compliance issue. Organizations with ATM networks should review endpoint protections and cash-handling monitoring for similar malware-delivery patterns.
Watch for additional OFAC designations and whether law enforcement releases IOCs linking specific malware families to the jackpotting campaign.
Timeline
-
original reporting
(chainalysis.com) Tren de Aragua's Multi-Million Dollar ATM Jackpotting Scheme: Malware, Crypto Laundering, and Transnational Crime Networks
www.chainalysis.com · 13d ago · September 30th, 2026
(chainalysis.com) Tren de Aragua's Multi-Million Dollar ATM Jackpotting Scheme: Malware, Crypto Laundering, and Transnational Crime Networks
via Mastodon https://www.chainalysis.com/blog/ofac-sanctions-tren-de-aragua-crypto-laundering-september-2026/
-
update from www.trmlabs.com
(trmlabs.com) OFAC Sanctions Tren de Aragua ATM Jackpotting Network and Designates Seven TRON Cryptocurrency Addresses In brief - This artic
www.trmlabs.com · 13d ago · September 30th, 2026
(trmlabs.com) OFAC Sanctions Tren de Aragua ATM Jackpotting Network and Designates Seven TRON Cryptocurrency Addresses In brief - This artic
via Mastodon https://www.trmlabs.com/resources/blog/treasury-sanctions-tren-de-aragua-atm-jackpotting-network-including-seven-tron-addresses
-
update from fawkes.rocks
ATM jackpotting: US sanctions 10 tied to Tren de Aragua https:// fawkes.rocks/2026/10/01/atm-ja ckpotting-us-sanctions-10-tied-to-tren-de-ar
fawkes.rocks · 13d ago · September 30th, 2026
ATM jackpotting: US sanctions 10 tied to Tren de Aragua https:// fawkes.rocks/2026/10/01/atm-ja ckpotting-us-sanctions-10-tied-to-tren-de-ar
via Mastodon https://fawkes.rocks/2026/10/01/atm-jackpotting-us-sanctions-10-tied-to-tren-de-aragua/
-
update from www.chainalysis.com
Bad Actor "“Prometheus”, one of the FBI’s Ten Most Wanted Fugitives engineered malware that “jackpotted” US ATMs, to the tune of ~$40M, then
www.chainalysis.com · 1d ago · October 12th, 2026
Bad Actor "“Prometheus”, one of the FBI’s Ten Most Wanted Fugitives engineered malware that “jackpotted” US ATMs, to the tune of ~$40M, then
via Mastodon https://www.chainalysis.com/blog/ofac-sanctions-tren-de-aragua-crypto-laundering-september-2026/