Audit log

Every state-changing event for Tren de Aragua Crypto-Laundering Network: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-10-01 12:04:35Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 452,282,389

   sig

   5mfNpnKQ1UUL…tP72geDocopyexplorer ↗

   hash

   HC3tVP4vC2z1…VWB2vDbRcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (24354 B) ▸

   {"actor":"system:backfill","investigation_id":"1b80bff2-bd96-4c4d-9244-bbe291c33a55","kind":"publish","page_slug":"tren-de-aragua-crypto-laundering-network","published_at":"2026-10-01T12:04:35.034Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Tren de Aragua Crypto-Laundering Network","sections":[{"content":"Tren de Aragua (TdA) is a Venezuelan transnational criminal organization originating in the Tocoron prison in Aragua state, Venezuela. On February 20, 2025, the U.S. Secretary of State designated TdA as a Foreign Terrorist Organization (FTO) and a Specially Designated Global Terrorist (SDGT) under U.S. law. The organization reportedly has thousands of members and operates across Latin America, the United States, and other countries. The ATM jackpotting network described on this page is alleged to be a key revenue-generating operation for TdA, according to the U.S. Treasury Department.","heading":"Background: Tren de Aragua and U.S. Government Designations","severity":"critical","sources":[{"credibility":1,"name":"Treasury Sanctions Financial Network of Tren de Aragua — U.S. Treasury Press Release","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0640"},{"credibility":1,"name":"State Department: Sanctioning Money Launderers Linked to Tren de Aragua","type":"regulatory","url":"https://www.state.gov/releases/office-of-the-spokesman/2026/09/sanctioning-money-launderers-linked-to-tren-de-araguas-multi-million-dollar-theft-scheme"}]},{"content":"According to DOJ indictments and Treasury filings, the TdA-linked network deployed a variant of Ploutus malware to force ATMs to dispense cash without debiting customer accounts — a technique known as ATM jackpotting. The malware allegedly targeted ATMs running legacy Windows XP systems and exploited the Kalignite ATM software platform's abstraction layer. Physical access was obtained to each targeted ATM; operators allegedly removed or replaced hard drives, installed Ploutus, then issued remote commands to dispense cash. A self-delete function was included in the malware to erase forensic traces after each attack. Reported U.S. losses from alleged TdA jackpotting attacks reached $40.73 million across more than 1,500 attacks as of August 2025, according to Treasury. The DOJ has charged 98 individuals in connection with this conspiracy since October 2025, with indictments filed in the U.S. District Court for the District of Nebraska. Five individuals pleaded guilty to related charges in August 2026 prior to the OFAC designation.","heading":"The ATM Jackpotting Operation","severity":"critical","sources":[{"credibility":1,"name":"Treasury Sanctions Financial Network of Tren de Aragua — U.S. Treasury Press Release","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0640"},{"credibility":1,"name":"DOJ: Tren de Aragua Members and Leaders Indicted in Multi-Million Dollar ATM Jackpotting Scheme","type":"court_filing","url":"https://www.justice.gov/usao-ne/pr/tren-de-aragua-members-and-leaders-indicted-multi-million-dollar-atm-jackpotting-scheme"},{"credibility":1,"name":"DOJ: Investigation into International ATM Jackpotting Scheme and Tren de Aragua — 87 Total Charged","type":"court_filing","url":"https://www.justice.gov/opa/pr/investigation-international-atm-jackpotting-scheme-and-tren-de-aragua-results-additional"},{"credibility":2,"name":"ATM Jackpotting Gang Accused of Unleashing Ploutus Malware Across US — The Register","type":"news_article","url":"https://www.theregister.com/2025/12/19/tren_de_aragua_atm/"},{"credibility":2,"name":"Rescana: Tren de Aragua ATM Jackpotting — Ploutus Malware Exploits Kalignite Platform","type":"research","url":"https://www.rescana.com/post/tren-de-aragua-atm-jackpotting-ploutus-malware-exploits-kalignite-platform-in-40m-us-attack"}]},{"content":"On September 30, 2026, OFAC added seven TRON blockchain addresses to the Specially Designated Nationals and Blocked Persons (SDN) List, each attributed to one of the designated individuals. According to TRM Labs blockchain analysis, the seven addresses are exchange-hosted deposit addresses on centralized cryptocurrency exchanges rather than self-custody wallets — a distinction that facilitates law-enforcement account identification. The seven addresses collectively received approximately $6.1 million in inflows since March 2022. The largest single address, attributed to Eric Gabriel Cardenas Arzola, received approximately $2.1 million. The most recent identified inflow to Cardenas Arzola's address occurred in July 2026. TRM Labs further found that these designated addresses forwarded funds to a secondary network of TdA-associated wallets, which subsequently transferred approximately $35 million to addresses connected to Venezuelan national Jorge Figueira. Figueira was separately indicted in January 2026 on charges of laundering approximately $1 billion in illicit funds using USDT stablecoins, OTC brokerages, and shell companies; he has not been convicted as of this writing. The seven sanctioned TRON addresses are: TJjRAn9kLiyh8h6gjBjaYjkfDkskgZfyW9 (Canelon Aguirre), TCUmMCHQEbFFdGvfdg2LeS64QfzUKP2AgW (Cardenas Arzola), THwbVuBBb26abe5TrAsYUpYz9mhWnBppdz (Galeano Bazurto), TBEmt7kPSwAv6NJTYKNdBVW524bUfPwJpJ (Hernandez Guerrero), TCifMAMwst3oEJx8GaNfqZw75dkFUa8vjG (Martinez Armenta), TDxZ1XTZCmqkJJW2eJT362z6omRchJyGBX (Martinez Pirona), and TWJmTGhquvdp1jhBmgeGxBBwefteGZUQYW (Mejia Castillo).","heading":"Cryptocurrency Laundering via TRON","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: Treasury Sanctions Tren de Aragua ATM Jackpotting Network Including Seven TRON Addresses","type":"on_chain","url":"https://www.trmlabs.com/resources/blog/treasury-sanctions-tren-de-aragua-atm-jackpotting-network-including-seven-tron-addresses"},{"credibility":1,"name":"Treasury Sanctions Financial Network of Tren de Aragua — U.S. Treasury Press Release","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0640"},{"credibility":2,"name":"Crypto.news: Seven TRON Addresses Sanctioned over Alleged Tren de Aragua ATM Attacks","type":"news_article","url":"https://crypto.news/seven-tron-addresses-sanctioned-over-alleged-tren-de-aragua-atm-attacks/"},{"credibility":2,"name":"Chainalysis: OFAC Sanctions Tren de Aragua Crypto-Laundering Network","type":"on_chain","url":"https://www.chainalysis.com/blog/ofac-sanctions-tren-de-aragua-crypto-laundering-september-2026/"}]},{"content":"OFAC's September 30, 2026 action designated 10 individuals and 2 Mexico-based companies. Anibal Alexander Canelon Aguirre (alias 'Prometheus' and 'El Ingeniero') is alleged by prosecutors to be the engineer of the Ploutus malware variant used in the attacks and is described as the alleged leader of the operation. He was indicted in the U.S. District Court for the District of Nebraska. Juan Gabriel Rivas Nunez (alias 'Juancho') is described by Treasury as a high-ranking TdA leader operating across multiple South American countries and was separately indicted in December 2025 on charges of material support to a designated foreign terrorist organization; his OFAC designation is distinct from the ATM jackpotting network and relates to TdA's broader criminal operations including illicit gold mining and narcotics. Six additional individuals — Eric Gabriel Cardenas Arzola, Jose Dario Galeano Bazurto, Anthony Wuiliam Hernandez Guerrero, Carlos Javier Martinez Armenta, Oscar Leonardo Martinez Pirona, and Alejandro Mejia Castillo — are each linked to one of the seven sanctioned TRON deposit addresses. Aslhy Javier Galeano Basurto, who was detained in the United States in 2017 on suspicion of ATM manipulation, was also designated. Two Mexico-incorporated entities were designated as well: Enigma Community, S. de R.L. de C.V. (owned by Oscar Leonardo Martinez Pirona) and Soluciones Integrales Toluca, S.A. de C.V. (owned by Alejandro Mejia Castillo). Maximum statutory penalties for the listed charges range from 20 to 335 years imprisonment; all charges represent allegations at this stage and no convictions have been reported for these designees as of this writing.","heading":"Designated Individuals and Entities","severity":"critical","sources":[{"credibility":1,"name":"Treasury Sanctions Financial Network of Tren de Aragua — U.S. Treasury Press Release","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0640"},{"credibility":2,"name":"TRM Labs: Treasury Sanctions Tren de Aragua ATM Jackpotting Network Including Seven TRON Addresses","type":"on_chain","url":"https://www.trmlabs.com/resources/blog/treasury-sanctions-tren-de-aragua-atm-jackpotting-network-including-seven-tron-addresses"},{"credibility":2,"name":"Fox Business: Treasury Sanctions Tren de Aragua, 10 Suspects in $40M ATM Jackpotting Bust","type":"news_article","url":"https://www.foxbusiness.com/politics/treasury-exposes-terror-network-tren-de-araguas-40m-us-atm-jackpotting-plot"}]},{"content":"On March 12, 2026, Anibal Alexander Canelon Aguirre was added to the FBI Ten Most Wanted Fugitives list, becoming the first individual characterized as a 'cyber fugitive' ever to appear on that list. The FBI offered a reward of up to $1,000,000 for information leading to his arrest. On approximately September 15, 2026, FBI Director Kash Patel announced during a Senate hearing that Canelon Aguirre had been captured in Venezuela. Latin-language reporting confirmed his arrest under the alias 'El Ingeniero.' Patel reportedly stated that his capture completed the FBI's apprehension of all ten fugitives then on its Ten Most Wanted list. As of September 30, 2026, no extradition to the United States had been publicly confirmed; the charges pending against him in the District of Nebraska remain allegations that have not been adjudicated.","heading":"Capture of Alleged Network Leader Canelon Aguirre","severity":"high","sources":[{"credibility":1,"name":"FBI Most Wanted on X: Canelon Aguirre Added to Ten Most Wanted Fugitives List","type":"official","url":"https://x.com/FBIMostWanted/status/2032140127745581179"},{"credibility":2,"name":"Breitbart: Kash Patel Reveals FBI Captured Most Wanted Cyber Fugitive in Venezuela","type":"news_article","url":"https://www.breitbart.com/latin-america/2026/09/16/kash-patel-reveals-fbi-captured-most-wanted-tren-de-aragua-cyber-fugitive-venezuela/"},{"credibility":2,"name":"Texas Border Business: Anibal Alexander Canelon Aguirre Added to FBI Ten Most Wanted","type":"news_article","url":"https://texasborderbusiness.com/anibal-alexander-canelon-aguirre-added-to-fbis-ten-most-wanted-fugitives-list/"},{"credibility":2,"name":"Voz.us: FBI Includes Anibal Canelon Aguirre on Ten Most Wanted List for Cybercrime","type":"news_article","url":"https://voz.us/en/society/260320/34301/the-fbi-includes-anibal-canelon-aguirre-on-its-list-of-the-ten-most-wanted-fugitives-for-cybercrime.html"}]},{"content":"On-chain analysis by TRM Labs identified that the seven OFAC-designated TRON deposit addresses forwarded funds to a secondary cluster of wallets associated with TdA. That secondary cluster then transferred approximately $35 million to addresses connected to Jorge Figueira, a Venezuelan national separately indicted in January 2026 in the U.S. District Court for the Eastern District of Virginia. Prosecutors allege that Figueira directed a professional laundering apparatus that processed nearly $1 billion in illicit funds using USDT stablecoins, over-the-counter brokerages registered in the United Kingdom and United States, shell companies, and accounts at regulated financial institutions. A 'macro-wallet' identified in the complaint allegedly received and disbursed more than $1 billion in USDT. Figueira has not been convicted; the charges remain allegations. The jurisdictions named in the complaint include Venezuela, Panama, Argentina, Colombia, the United States, China, Dubai, Spain, and Germany.","heading":"Connection to Jorge Figueira Professional Money-Laundering Network","severity":"high","sources":[{"credibility":2,"name":"TRM Labs: Treasury Sanctions Tren de Aragua ATM Jackpotting Network Including Seven TRON Addresses","type":"on_chain","url":"https://www.trmlabs.com/resources/blog/treasury-sanctions-tren-de-aragua-atm-jackpotting-network-including-seven-tron-addresses"},{"credibility":2,"name":"Yahoo Finance: Venezuelan Man Faces 20 Years for Alleged $1B Crypto Money Laundering Scheme","type":"news_article","url":"https://finance.yahoo.com/news/venezuelan-man-faces-20-years-160929219.html"},{"credibility":2,"name":"Gizmodo: DOJ Alleges One Venezuelan Used Tether to Launder $1 Billion for Criminals","type":"news_article","url":"https://gizmodo.com/doj-alleges-one-venezuelan-used-crypto-stablecoin-tether-to-launder-1-billion-for-criminals-2000711586"},{"credibility":2,"name":"Sanctions Expert: Analysis of the Figueira Professional Crypto Laundering and Sanctions Evasion Indictment","type":"research","url":"https://www.sanctionsexpert.com/post/green-and-white-money-an-analysis-of-the-figueira-professional-crypto-laundering-and-sanctions-evasion-indictment"}]},{"content":"The seven TRON addresses added to the OFAC SDN List on September 30, 2026 are subject to U.S. sanctions. Any U.S. person or entity that transacts with these addresses — or with any entity that is 50% or more owned by a designated person — faces potential civil and criminal liability under U.S. sanctions law. Because all seven addresses are exchange-hosted deposit addresses on centralized exchanges rather than self-custody wallets, the host exchanges are expected to freeze associated accounts. Cryptocurrency businesses operating under U.S. jurisdiction should screen these addresses in their compliance pipelines. The TRON blockchain was the exclusive on-chain instrument identified in this operation; no Bitcoin, Ethereum, or other chain addresses were designated in this specific action.","heading":"Sanctions Compliance and Blockchain Risk","severity":"critical","sources":[{"credibility":1,"name":"Treasury Sanctions Financial Network of Tren de Aragua — U.S. Treasury Press Release","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0640"},{"credibility":2,"name":"TRM Labs: Treasury Sanctions Tren de Aragua ATM Jackpotting Network Including Seven TRON Addresses","type":"on_chain","url":"https://www.trmlabs.com/resources/blog/treasury-sanctions-tren-de-aragua-atm-jackpotting-network-including-seven-tron-addresses"},{"credibility":2,"name":"The Record: US Sanctions 10 over ATM Malware Scheme Tied to Tren de Aragua","type":"news_article","url":"https://therecord.media/us-sanctions-10-atm-jackpotting-tren-de-aragua"}]}],"sources_used":[{"credibility":1,"name":"U.S. Treasury: Treasury Sanctions Financial Network of Foreign Terrorist Organization Tren de Aragua","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0640"},{"credibility":2,"name":"TRM Labs: Treasury Sanctions Tren de Aragua ATM Jackpotting Network Including Seven TRON Addresses","type":"on_chain","url":"https://www.trmlabs.com/resources/blog/treasury-sanctions-tren-de-aragua-atm-jackpotting-network-including-seven-tron-addresses"},{"credibility":2,"name":"Chainalysis: OFAC Sanctions Tren de Aragua Crypto-Laundering Network","type":"on_chain","url":"https://www.chainalysis.com/blog/ofac-sanctions-tren-de-aragua-crypto-laundering-september-2026/"},{"credibility":1,"name":"DOJ: Tren de Aragua Members and Leaders Indicted — District of Nebraska","type":"court_filing","url":"https://www.justice.gov/usao-ne/pr/tren-de-aragua-members-and-leaders-indicted-multi-million-dollar-atm-jackpotting-scheme"},{"credibility":1,"name":"DOJ: Investigation into International ATM Jackpotting Scheme — 87 Total Charged","type":"court_filing","url":"https://www.justice.gov/opa/pr/investigation-international-atm-jackpotting-scheme-and-tren-de-aragua-results-additional"},{"credibility":1,"name":"State Department: Sanctioning Money Launderers Linked to Tren de Aragua","type":"regulatory","url":"https://www.state.gov/releases/office-of-the-spokesman/2026/09/sanctioning-money-launderers-linked-to-tren-de-araguas-multi-million-dollar-theft-scheme"},{"credibility":2,"name":"The Record: US Sanctions 10 over ATM Malware Scheme Tied to Tren de Aragua","type":"news_article","url":"https://therecord.media/us-sanctions-10-atm-jackpotting-tren-de-aragua"},{"credibility":2,"name":"Fox Business: Treasury Sanctions Tren de Aragua, 10 Suspects in $40M ATM Jackpotting Bust","type":"news_article","url":"https://www.foxbusiness.com/politics/treasury-exposes-terror-network-tren-de-araguas-40m-us-atm-jackpotting-plot"},{"credibility":2,"name":"Crypto.news: Seven TRON Addresses Sanctioned over Alleged Tren de Aragua ATM Attacks","type":"news_article","url":"https://crypto.news/seven-tron-addresses-sanctioned-over-alleged-tren-de-aragua-atm-attacks/"},{"credibility":2,"name":"The Register: ATM Jackpotting Gang Accused of Unleashing Ploutus Malware Across US","type":"news_article","url":"https://www.theregister.com/2025/12/19/tren_de_aragua_atm/"},{"credibility":2,"name":"HSToday: 54 Tren de Aragua Gang Members Indicted in Multi-Million Dollar Malware-Based ATM Fraud Scheme","type":"news_article","url":"https://www.hstoday.us/subject-matter-areas/cybersecurity/54-tren-de-aragua-gang-members-indicted-in-multi-million-dollar-malware-based-atm-jackpotting-scheme/"},{"credibility":2,"name":"Texas Border Business: Anibal Alexander Canelon Aguirre Added to FBI Ten Most Wanted","type":"news_article","url":"https://texasborderbusiness.com/anibal-alexander-canelon-aguirre-added-to-fbis-ten-most-wanted-fugitives-list/"},{"credibility":2,"name":"Breitbart: Kash Patel Reveals FBI Captured Most Wanted Cyber Fugitive in Venezuela","type":"news_article","url":"https://www.breitbart.com/latin-america/2026/09/16/kash-patel-reveals-fbi-captured-most-wanted-tren-de-aragua-cyber-fugitive-venezuela/"},{"credibility":2,"name":"Yahoo Finance: Venezuelan Man Faces 20 Years for Alleged $1B Crypto Money Laundering Scheme (Figueira)","type":"news_article","url":"https://finance.yahoo.com/news/venezuelan-man-faces-20-years-160929219.html"},{"credibility":2,"name":"Gizmodo: DOJ Alleges One Venezuelan Used Tether to Launder $1 Billion for Criminals","type":"news_article","url":"https://gizmodo.com/doj-alleges-one-venezuelan-used-crypto-stablecoin-tether-to-launder-1-billion-for-criminals-2000711586"},{"credibility":2,"name":"1011now.com: Federal Grand Jury in Nebraska Indicts Six More People in Massive ATM Jackpotting Scheme","type":"news_article","url":"https://www.1011now.com/2026/02/20/federal-grand-jury-nebraska-indicts-six-more-people-massive-atm-jackpotting-scheme/"},{"credibility":2,"name":"Rescana: Tren de Aragua ATM Jackpotting — Ploutus Malware and Kalignite Platform","type":"research","url":"https://www.rescana.com/post/tren-de-aragua-atm-jackpotting-ploutus-malware-exploits-kalignite-platform-in-40m-us-attack"},{"credibility":2,"name":"Voz.us: FBI Includes Anibal Canelon Aguirre on Ten Most Wanted for Cybercrime","type":"news_article","url":"https://voz.us/en/society/260320/34301/the-fbi-includes-anibal-canelon-aguirre-on-its-list-of-the-ten-most-wanted-fugitives-for-cybercrime.html"},{"credibility":2,"name":"Sanctions Expert: Analysis of the Figueira Professional Crypto Laundering Indictment","type":"research","url":"https://www.sanctionsexpert.com/post/green-and-white-money-an-analysis-of-the-figueira-professional-crypto-laundering-and-sanctions-evasion-indictment"}],"summary":"The Tren de Aragua (TdA) crypto-laundering network is a sub-operation of the Venezuelan transnational criminal organization Tren de Aragua, which the U.S. government designated as a Foreign Terrorist Organization in February 2025. On September 30, 2026, OFAC sanctioned 10 individuals and 2 Mexico-based companies connected to an ATM jackpotting scheme that caused reported losses of $40.73 million across more than 1,500 attacks on U.S. financial institutions, with proceeds allegedly laundered through seven TRON blockchain addresses and a secondary network linked to a $1 billion professional money-laundering operation. The alleged malware architect, Anibal Alexander Canelon Aguirre, was added to the FBI Ten Most Wanted Fugitives list in March 2026 and captured in Venezuela in September 2026; as of the investigation date he has not yet been extradited or tried.","timeline":[{"date":"2022-03-01","event":"Earliest tracked inflows to the seven OFAC-designated TRON deposit addresses begin, per TRM Labs analysis.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/treasury-sanctions-tren-de-aragua-atm-jackpotting-network-including-seven-tron-addresses"},{"date":"2025-02-20","event":"U.S. Secretary of State designates Tren de Aragua as a Foreign Terrorist Organization (FTO) and Specially Designated Global Terrorist (SDGT).","source":"U.S. State Department","source_url":"https://www.state.gov/releases/office-of-the-spokesman/2026/09/sanctioning-money-launderers-linked-to-tren-de-araguas-multi-million-dollar-theft-scheme"},{"date":"2025-08-01","event":"As of this date, reported U.S. losses from alleged TdA ATM jackpotting attacks total $40.73 million across more than 1,500 attacks, per Treasury data.","source":"U.S. Treasury / OFAC","source_url":"https://home.treasury.gov/news/press-releases/sb0640"},{"date":"2025-10-21","event":"DOJ begins indicting individuals for the ATM jackpotting conspiracy; initial indictments filed in U.S. District Court for the District of Nebraska.","source":"DOJ","source_url":"https://www.justice.gov/usao-ne/pr/tren-de-aragua-members-and-leaders-indicted-multi-million-dollar-atm-jackpotting-scheme"},{"date":"2025-12-01","event":"DOJ announces indictment of 54 TdA-linked individuals in the ATM jackpotting scheme. Juan Gabriel Rivas Nunez separately indicted for material support to TdA.","source":"HSToday / DOJ","source_url":"https://www.hstoday.us/subject-matter-areas/cybersecurity/54-tren-de-aragua-gang-members-indicted-in-multi-million-dollar-malware-based-atm-jackpotting-scheme/"},{"date":"2026-01-01","event":"Federal grand jury in Nebraska indicts additional defendants; total charged defendants reach 87. DOJ also indicts Jorge Figueira in the Eastern District of Virginia for allegedly laundering approximately $1 billion in illicit funds.","source":"DOJ / Yahoo Finance","source_url":"https://www.justice.gov/opa/pr/investigation-international-atm-jackpotting-scheme-and-tren-de-aragua-results-additional"},{"date":"2026-02-20","event":"Federal grand jury in Nebraska indicts six more individuals, bringing total charged defendants to 93.","source":"1011now.com","source_url":"https://www.1011now.com/2026/02/20/federal-grand-jury-nebraska-indicts-six-more-people-massive-atm-jackpotting-scheme/"},{"date":"2026-03-12","event":"FBI adds Anibal Alexander Canelon Aguirre to its Ten Most Wanted Fugitives list — the first individual designated as a cyber fugitive on the list. A $1,000,000 reward is offered.","source":"FBI / Texas Border Business","source_url":"https://texasborderbusiness.com/anibal-alexander-canelon-aguirre-added-to-fbis-ten-most-wanted-fugitives-list/"},{"date":"2026-07-01","event":"Most recent inflow identified to the TRON address attributed to Eric Gabriel Cardenas Arzola, per TRM Labs.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/treasury-sanctions-tren-de-aragua-atm-jackpotting-network-including-seven-tron-addresses"},{"date":"2026-09-15","event":"FBI Director Kash Patel announces the capture of Canelon Aguirre in Venezuela. He is described as the last fugitive from the FBI Ten Most Wanted list to be apprehended. Extradition status not publicly confirmed as of the OFAC designation date.","source":"Breitbart / Latin Times","source_url":"https://www.breitbart.com/latin-america/2026/09/16/kash-patel-reveals-fbi-captured-most-wanted-tren-de-aragua-cyber-fugitive-venezuela/"},{"date":"2026-09-30","event":"OFAC designates 10 individuals and 2 Mexico-based entities linked to the TdA ATM jackpotting network and adds seven TRON addresses to the SDN List. DOJ total indictment count reaches 98.","source":"U.S. Treasury","source_url":"https://home.treasury.gov/news/press-releases/sb0640"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 99c4f933-90dd-47dd-b515-44f4870eeea0copy