Anibal Alexander Canelon Aguirre
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4GNnGB…gFykSummary
Anibal Alexander Canelon Aguirre, a Venezuelan national born May 15, 1976 and known by the aliases 'Prometheus' and 'The Engineer,' is alleged by U.S. prosecutors to be the architect of a Tren de Aragua-linked ATM jackpotting and cryptocurrency laundering operation that prosecutors say caused $40.73 million in losses across more than 1,500 U.S. financial institutions. He was federally indicted in the District of Nebraska on December 9, 2025, added to the FBI Ten Most Wanted Fugitives list on March 12, 2026, and designated by OFAC as a Specially Designated National on September 30, 2026; his capture in Venezuela was announced by FBI Director Kash Patel on September 15, 2026, with extradition proceedings reportedly underway as of that date.
Connected Entities
8 entities · 1 linked investigation- TWJmTG…UQYW→mentioned with→Anibal Alexander Canelon Aguirre(50%)
- TJjRAn…fyW9→mentioned with→Anibal Alexander Canelon Aguirre(50%)
- TCifMA…8vjG→mentioned with→Anibal Alexander Canelon Aguirre(50%)
- TCUmMC…2AgW→mentioned with→Anibal Alexander Canelon Aguirre(50%)
- TBEmt7…wJpJ→mentioned with→Anibal Alexander Canelon Aguirre(50%)
- THwbVu…ppdz→mentioned with→Anibal Alexander Canelon Aguirre(50%)
- TDxZ1X…yGBX→mentioned with→Anibal Alexander Canelon Aguirre(50%)
Connected Through
7 shared actors · 1 investigationDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ◇TCUmMC…2AgWwallet
- ◇TJjRAn…fyW9wallet
- ◇TWJmTG…UQYWwallet
- ◇TBEmt7…wJpJwallet
- ◇TDxZ1X…yGBXwallet
- ◇TCifMA…8vjGwallet
- ◇THwbVu…ppdzwallet
Timeline(10 events)
October 2020
Mexican intelligence documents reportedly identified Canelon Aguirre as a developer of Ploutus.D malware, at that time associated with the Riviera Maya Gang targeting ATMs in Cancun and the United States.
OCCRPMarch 2022
Earliest traceable inflows begin to the seven TRON addresses later sanctioned by OFAC, according to blockchain analytics.
TRM LabsJanuary 2024
Prosecutors allege ATM jackpotting attacks by Canelon Aguirre's network began at least by this date, targeting U.S. financial institutions using Ploutus malware.
FBI / TreasuryAugust 2025
Reported losses from alleged ATM jackpotting attacks attributed to the TdA network reached $40.73 million across more than 1,500 attacks, per Treasury's cited figures.
Treasury Press Release SB06409 December 2025
Federal arrest warrant issued by the U.S. District Court for the District of Nebraska, charging Canelon Aguirre with conspiracy to commit bank fraud, bank burglary, computer damage, money laundering, and material support to a foreign terrorist organization.
FBI / Treasury12 March 2026
Canelon Aguirre added to the FBI Ten Most Wanted Fugitives list — the first person added primarily for alleged cybercrimes, and the first fugitive added by the Omaha FBI Field Office since 1975. FBI offers $1 million reward.
Journal Star / FBIJuly 2026
Most recent deposit recorded to one of the seven TRON addresses later sanctioned by OFAC (attributed to co-designee Eric Gabriel Cardenas Arzola), per blockchain analytics.
TRM Labs13 September 2026
Canelon Aguirre reportedly captured in Venezuela over the weekend preceding FBI Director Kash Patel's Senate testimony, according to multiple news outlets.
Infobae / Euronews15 September 2026
FBI Director Kash Patel publicly announced the capture of Canelon Aguirre in Venezuela during testimony before the U.S. Senate Judiciary Committee; reports indicated extradition transport to the U.S. was underway.
Infobae / Latin Times30 September 2026
OFAC designated Canelon Aguirre and eight other individuals and two Mexico-based entities as Specially Designated Nationals, adding seven TRON wallet addresses to the SDN list. His TRON address TJjRAn9kLiyh8h6gjBjaYjkfDkskgZfyW9 was among the designated assets.
OFAC / TreasuryDecision Log
- hash: CELmXMQ89Wf4LmRGQKBjJXA3gUyyzmBkxbUqMrR4oRQC
This investigation is cryptographically anchored to the Solana blockchain (1 event). 14 of 14 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 10/1/2026, 12:08:07 PM
last updated: 10/2/2026, 3:30:04 AM
avoid.net — verified advice for a post-truth world