Verify a decision

{"actor":"system:backfill","investigation_id":"d2b0b032-44a1-4810-ba87-4831364b0548","kind":"publish","page_slug":"anibal-alexander-canelon-aguirre","published_at":"2026-10-01T12:08:17.792Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Anibal Alexander Canelon Aguirre","sections":[{"content":"On September 30, 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) designated Anibal Alexander Canelon Aguirre as a Specially Designated National under counter-terrorism and transnational criminal organization authorities. The designation was part of a broader action targeting ten individuals and two Mexico-based entities alleged to comprise the financial network supporting Tren de Aragua's ATM jackpotting and cryptocurrency laundering operation. OFAC attributed to Canelon Aguirre one TRON wallet address — TJjRAn9kLiyh8h6gjBjaYjkfDkskgZfyW9 — which it added to the SDN List. His Venezuelan national ID number (cedula) is V-13126628. The SDN listing blocks all U.S.-person transactions with the designated individuals and entities and freezes any assets within U.S. jurisdiction. OpenSanctions records confirm the designation effective September 30, 2026.","heading":"OFAC Designation and SDN Listing","severity":"critical","sources":[{"credibility":1,"name":"OFAC Recent Actions — September 30, 2026","type":"regulatory","url":"https://ofac.treasury.gov/recent-actions/20260930"},{"credibility":1,"name":"Treasury Press Release SB0640 — Treasury Sanctions Financial Network of Foreign Terrorist Organization Tren de Aragua","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0640"},{"credibility":1,"name":"OpenSanctions — Anibal Alexander Canelon Aguirre (ofac-58161)","type":"regulatory","url":"https://www.opensanctions.org/entities/ofac-58161/"}]},{"content":"A federal arrest warrant was issued for Canelon Aguirre on December 9, 2025 by the U.S. District Court for the District of Nebraska (Omaha). He is charged with: conspiracy to commit bank fraud; conspiracy to commit bank burglary and intentionally damage a protected computer system; conspiracy to commit money laundering; and conspiracy to provide material support to a designated foreign terrorist organization (Tren de Aragua). These are charges and allegations; no conviction had been entered as of the most recent available reporting. On March 12, 2026, Canelon Aguirre was added to the FBI Ten Most Wanted Fugitives list — the first time the Omaha FBI Field Office had placed a fugitive on the national list since 1975, and the first person added primarily on the basis of alleged cybercrimes. The FBI offered a reward of up to $1 million for information leading to his arrest. Prosecutors allege that if convicted, defendants in the broader jackpotting conspiracy face maximum penalties of between 20 and 335 years in prison. The Justice Department states it has secured charges against 93 Tren de Aragua members and leaders in connection with the ATM jackpotting scheme, with 119 individuals indicted in total; several defendants have already received sentences ranging from 78 to 96 months.","heading":"Federal Indictment and FBI Ten Most Wanted Status","severity":"critical","sources":[{"credibility":1,"name":"Treasury Press Release SB0640","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0640"},{"credibility":1,"name":"FBI Ten Most Wanted — Anibal Alexander Canelon Aguirre (reward poster)","type":"official","url":"https://www.fbi.gov/wanted/topten/anibal-alexander-canelon-aguirre/aguirre-ten-most-wanted-web-8-5x11.pdf"},{"credibility":2,"name":"Journal Star — First time since 1975: FBI Omaha adds cybercrime boss to Ten Most Wanted","type":"news_article","url":"https://journalstar.com/news/state-regional/nebraska/article_ae0a958c-bd88-58fc-80b0-21e3a818df71.html"},{"credibility":2,"name":"SecurityWeek — Treasury Blacklists Most-Wanted ATM Malware Developer and His Network","type":"news_article","url":"https://www.securityweek.com/treasury-blacklists-most-wanted-atm-malware-developer-and-his-network/"}]},{"content":"According to the U.S. Treasury and federal prosecutors, Canelon Aguirre is the alleged engineer of the Ploutus.D malware used in the jackpotting attacks. Ploutus is a family of malware designed to force ATMs to dispense cash on command without authorization. Prosecutors allege that Canelon Aguirre directed numerous crews operating inside the United States who would physically access ATM machines, install the malware, and trigger unauthorized cash withdrawals. Mexican intelligence documents from October 2020, cited in OCCRP reporting, identified him as a developer of Ploutus.D malware previously associated with the Riviera Maya Gang, a Romanian-led criminal group that targeted ATMs in Cancun and the United States — suggesting the alleged malware development predates his alleged Tren de Aragua involvement. Treasury states that as of August 2025, reported losses from alleged ATM jackpotting attacks in the United States attributed to this network total $40.73 million across more than 1,500 attacks. Canelon Aguirre has been photographed posing with proceeds of the crime, according to Treasury. He allegedly coordinated the laundering of stolen proceeds through cryptocurrency, specifically TRON-based transactions. All claims of criminal conduct are allegations; no conviction has been entered.","heading":"Alleged Role: ATM Jackpotting Malware and Tren de Aragua Financial Operations","severity":"critical","sources":[{"credibility":1,"name":"Treasury Press Release SB0640","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0640"},{"credibility":1,"name":"OCCRP — The US Blacklists Alleged Venezuelan Cyber Crime Mastermind","type":"news_article","url":"https://www.occrp.org/en/news/the-us-blacklists-alleged-venezuelan-cyber-crime-mastermind"},{"credibility":2,"name":"TRM Labs — Treasury Sanctions Tren de Aragua ATM Jackpotting Network, Including Seven TRON Addresses","type":"research","url":"https://www.trmlabs.com/resources/blog/treasury-sanctions-tren-de-aragua-atm-jackpotting-network-including-seven-tron-addresses"}]},{"content":"OFAC designated seven TRON wallet addresses associated with Canelon Aguirre and six alleged co-conspirators. The address attributed directly to Canelon Aguirre is TJjRAn9kLiyh8h6gjBjaYjkfDkskgZfyW9. Collectively, the seven designated addresses received approximately $6.1 million in total inflows since March 2022, according to blockchain analytics. The largest single address — attributed to co-designee Eric Gabriel Cardenas Arzola — received roughly $2.1 million, with the most recent deposit occurring in July 2026. All seven addresses functioned as deposit addresses hosted at a centralized cryptocurrency exchange, a structure that U.S. authorities note could enable the exchange to identify account holders and examine related transactions. On-chain analysis shows the designated addresses sent funds onward to other addresses associated with Tren de Aragua, which in turn transferred approximately $35 million to a network that U.S. authorities have affiliated with Jorge Figueira, a Venezuelan national separately charged with laundering approximately $1 billion in illicit proceeds. The $6.1 million figure represents traceable inflows to the specifically sanctioned addresses; total proceeds flowing through the broader network are alleged to be substantially larger.","heading":"Cryptocurrency Laundering: TRON Wallets and On-Chain Flows","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs — Treasury Sanctions Tren de Aragua ATM Jackpotting Network, Including Seven TRON Addresses","type":"research","url":"https://www.trmlabs.com/resources/blog/treasury-sanctions-tren-de-aragua-atm-jackpotting-network-including-seven-tron-addresses"},{"credibility":2,"name":"Chainalysis — OFAC Sanctions Tren de Aragua Crypto-Laundering Network","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-tren-de-aragua-crypto-laundering-september-2026/"},{"credibility":1,"name":"OpenSanctions — Anibal Alexander Canelon Aguirre (TRON address TJjRAn9kLiyh8h6gjBjaYjkfDkskgZfyW9)","type":"regulatory","url":"https://www.opensanctions.org/entities/ofac-58161/"},{"credibility":1,"name":"DOJ — Venezuelan National Charged in $1 Billion Cryptocurrency Money Laundering Scheme (Jorge Figueira)","type":"court_filing","url":"https://www.justice.gov/usao-edva/pr/venezuelan-national-charged-laundering-approximately-billion-dollars-illicit-funds"}]},{"content":"On September 15, 2026, FBI Director Kash Patel announced during testimony before the U.S. Senate Judiciary Committee that Canelon Aguirre had been captured in Venezuela over the preceding weekend. Multiple Spanish-language outlets including Infobae and Euronews reported that he was already in the process of being transported to the United States at the time of the announcement. This would have made him the last fugitive removed from the FBI Ten Most Wanted list at that time, completing the list's roster. His removal from the wanted list and formal extradition status as of the September 30, 2026 OFAC designation date are not confirmed in available English-language primary sources reviewed for this page; the OFAC designation proceeding on September 30 — fifteen days after the reported capture announcement — may indicate that extradition and formal U.S. custody had not yet been completed, or that the designation was finalized in parallel with the custody transfer. Readers should note that the extradition and custody status described in press reports remains unconfirmed in primary U.S. court records available at time of writing.","heading":"Capture in Venezuela and Extradition Proceedings","severity":"high","sources":[{"credibility":2,"name":"Infobae — Estados Unidos capturó en Venezuela a uno de los delincuentes más buscados por el FBI","type":"news_article","url":"https://www.infobae.com/estados-unidos/2026/09/15/estados-unidos-capturo-en-venezuela-a-uno-de-los-delincuentes-mas-buscados-por-el-fbi-acusado-de-financiar-al-tren-de-aragua/"},{"credibility":2,"name":"Euronews (Spanish) — El FBI captura en Venezuela al último fugitivo de su lista de los 10 más buscados","type":"news_article","url":"https://es.euronews.com/2026/09/16/fbi-captura-venezuela-ultimo-fugitivo-mas-buscados"},{"credibility":3,"name":"Breitbart — Kash Patel Reveals FBI Captured Most Wanted Cyber Fugitive in Venezuela","type":"news_article","url":"https://www.breitbart.com/latin-america/2026/09/16/kash-patel-reveals-fbi-captured-most-wanted-tren-de-aragua-cyber-fugitive-venezuela/"},{"credibility":2,"name":"Latin Times — FBI Captures The Engineer in Venezuela, First Cybercriminal Added to Ten Most Wanted List","type":"news_article","url":"https://www.latintimes.com/fbi-captures-engineer-venezuela-first-cybercriminal-added-ten-most-wanted-list-599267"}]},{"content":"The September 30, 2026 OFAC action designated eight individuals in total alongside Canelon Aguirre, each attributed a TRON wallet address on the SDN list. The six associates also indicted in the Nebraska federal case are: Carlos Javier Martinez Armenta (TRON: TCifMAMwst3oEJx8GaNfqZw75dkFUa8vjG); Alejandro Mejia Castillo (TRON: TWJmTGhquvdp1jhBmgeGxBBwefteGZUQYW); Jose Dario Galeano Bazurto (TRON: THwbVuBBb26abe5TrAsYUpYz9mhWnBppdz); Eric Gabriel Cardenas Arzola (TRON: TCUmMCHQEbFFdGvfdg2LeS64QfzUKP2AgW); Oscar Leonardo Martinez Pirona (TRON: TDxZ1XTZCmqkJJW2eJT362z6omRchJyGBX); and Anthony Wuiliam Hernandez Guerrero (TRON: TBEmt7kPSwAv6NJTYKNdBVW524bUfPwJpJ). A ninth individual designated in the same action was connected to a separate Tren de Aragua gold-mining operation. Two Mexico-based companies were also designated as entities. The broader jackpotting conspiracy has resulted in charges against 119 individuals across multiple federal districts, with several defendants already sentenced to terms of 78–96 months.","heading":"Co-Designees and Associated Network","severity":"high","sources":[{"credibility":2,"name":"TRM Labs — Treasury Sanctions Tren de Aragua ATM Jackpotting Network","type":"research","url":"https://www.trmlabs.com/resources/blog/treasury-sanctions-tren-de-aragua-atm-jackpotting-network-including-seven-tron-addresses"},{"credibility":1,"name":"Treasury Press Release SB0640","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0640"}]},{"content":"Tren de Aragua (TdA) is a Venezuelan transnational criminal organization that the U.S. government designated as a Foreign Terrorist Organization (FTO) and Specially Designated Global Terrorist (SDGT). The organization originated in Tocorón Prison in Venezuela and has expanded operations across Latin America and into the United States. Canelon Aguirre's alleged material support to TdA forms one of the criminal counts in the Nebraska indictment and is also the basis for OFAC's counter-terrorism designation authority used in the September 30 action. The connection to TdA means that providing funds, services, or material support to Canelon Aguirre or the designated wallets constitutes a potential violation of U.S. counter-terrorism statutes in addition to standard sanctions law.","heading":"Tren de Aragua Designation Context","severity":"critical","sources":[{"credibility":1,"name":"Treasury Press Release SB0640","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0640"},{"credibility":2,"name":"Chainalysis — OFAC Sanctions Tren de Aragua Crypto-Laundering Network","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-tren-de-aragua-crypto-laundering-september-2026/"}]}],"sources_used":[{"credibility":1,"name":"OFAC Recent Actions — September 30, 2026","type":"regulatory","url":"https://ofac.treasury.gov/recent-actions/20260930"},{"credibility":1,"name":"Treasury Press Release SB0640 — Treasury Sanctions Financial Network of Foreign Terrorist Organization Tren de Aragua","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0640"},{"credibility":1,"name":"OpenSanctions — Anibal Alexander Canelon Aguirre (ofac-58161)","type":"regulatory","url":"https://www.opensanctions.org/entities/ofac-58161/"},{"credibility":1,"name":"FBI Ten Most Wanted Reward Poster — Anibal Alexander Canelon Aguirre","type":"official","url":"https://www.fbi.gov/wanted/topten/anibal-alexander-canelon-aguirre/aguirre-ten-most-wanted-web-8-5x11.pdf"},{"credibility":1,"name":"DOJ USAO-EDVA — Venezuelan National Charged in $1 Billion Cryptocurrency Money Laundering Scheme (Jorge Figueira)","type":"court_filing","url":"https://www.justice.gov/usao-edva/pr/venezuelan-national-charged-laundering-approximately-billion-dollars-illicit-funds"},{"credibility":2,"name":"TRM Labs — Treasury Sanctions Tren de Aragua ATM Jackpotting Network, Including Seven TRON Addresses","type":"research","url":"https://www.trmlabs.com/resources/blog/treasury-sanctions-tren-de-aragua-atm-jackpotting-network-including-seven-tron-addresses"},{"credibility":2,"name":"Chainalysis — OFAC Sanctions Tren de Aragua Crypto-Laundering Network","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-tren-de-aragua-crypto-laundering-september-2026/"},{"credibility":1,"name":"OCCRP — The US Blacklists Alleged Venezuelan Cyber Crime Mastermind","type":"news_article","url":"https://www.occrp.org/en/news/the-us-blacklists-alleged-venezuelan-cyber-crime-mastermind"},{"credibility":2,"name":"SecurityWeek — Treasury Blacklists Most-Wanted ATM Malware Developer and His Network","type":"news_article","url":"https://www.securityweek.com/treasury-blacklists-most-wanted-atm-malware-developer-and-his-network/"},{"credibility":2,"name":"Journal Star — First time since 1975: FBI Omaha adds cybercrime boss to Ten Most Wanted","type":"news_article","url":"https://journalstar.com/news/state-regional/nebraska/article_ae0a958c-bd88-58fc-80b0-21e3a818df71.html"},{"credibility":2,"name":"Latin Times — FBI Captures The Engineer in Venezuela, First Cybercriminal Added to Ten Most Wanted List","type":"news_article","url":"https://www.latintimes.com/fbi-captures-engineer-venezuela-first-cybercriminal-added-ten-most-wanted-list-599267"},{"credibility":2,"name":"Infobae — Estados Unidos capturó en Venezuela a uno de los delincuentes más buscados por el FBI","type":"news_article","url":"https://www.infobae.com/estados-unidos/2026/09/15/estados-unidos-capturo-en-venezuela-a-uno-de-los-delincuentes-mas-buscados-por-el-fbi-acusado-de-financiar-al-tren-de-aragua/"},{"credibility":2,"name":"Euronews (Spanish) — El FBI captura en Venezuela al último fugitivo de su lista de los 10 más buscados","type":"news_article","url":"https://es.euronews.com/2026/09/16/fbi-captura-venezuela-ultimo-fugitivo-mas-buscados"},{"credibility":2,"name":"crypto.news — Seven TRON addresses sanctioned over alleged Tren de Aragua ATM attacks","type":"news_article","url":"https://crypto.news/seven-tron-addresses-sanctioned-over-alleged-tren-de-aragua-atm-attacks/"}],"summary":"Anibal Alexander Canelon Aguirre, a Venezuelan national born May 15, 1976 and known by the aliases 'Prometheus' and 'The Engineer,' is alleged by U.S. prosecutors to be the architect of a Tren de Aragua-linked ATM jackpotting and cryptocurrency laundering operation that prosecutors say caused $40.73 million in losses across more than 1,500 U.S. financial institutions. He was federally indicted in the District of Nebraska on December 9, 2025, added to the FBI Ten Most Wanted Fugitives list on March 12, 2026, and designated by OFAC as a Specially Designated National on September 30, 2026; his capture in Venezuela was announced by FBI Director Kash Patel on September 15, 2026, with extradition proceedings reportedly underway as of that date.","timeline":[{"date":"2020-10","event":"Mexican intelligence documents reportedly identified Canelon Aguirre as a developer of Ploutus.D malware, at that time associated with the Riviera Maya Gang targeting ATMs in Cancun and the United States.","source":"OCCRP","source_url":"https://www.occrp.org/en/news/the-us-blacklists-alleged-venezuelan-cyber-crime-mastermind"},{"date":"2022-03","event":"Earliest traceable inflows begin to the seven TRON addresses later sanctioned by OFAC, according to blockchain analytics.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/treasury-sanctions-tren-de-aragua-atm-jackpotting-network-including-seven-tron-addresses"},{"date":"2024-01","event":"Prosecutors allege ATM jackpotting attacks by Canelon Aguirre's network began at least by this date, targeting U.S. financial institutions using Ploutus malware.","source":"FBI / Treasury","source_url":"https://home.treasury.gov/news/press-releases/sb0640"},{"date":"2025-08","event":"Reported losses from alleged ATM jackpotting attacks attributed to the TdA network reached $40.73 million across more than 1,500 attacks, per Treasury's cited figures.","source":"Treasury Press Release SB0640","source_url":"https://home.treasury.gov/news/press-releases/sb0640"},{"date":"2025-12-09","event":"Federal arrest warrant issued by the U.S. District Court for the District of Nebraska, charging Canelon Aguirre with conspiracy to commit bank fraud, bank burglary, computer damage, money laundering, and material support to a foreign terrorist organization.","source":"FBI / Treasury","source_url":"https://www.fbi.gov/wanted/topten/anibal-alexander-canelon-aguirre/aguirre-ten-most-wanted-web-8-5x11.pdf"},{"date":"2026-03-12","event":"Canelon Aguirre added to the FBI Ten Most Wanted Fugitives list — the first person added primarily for alleged cybercrimes, and the first fugitive added by the Omaha FBI Field Office since 1975. FBI offers $1 million reward.","source":"Journal Star / FBI","source_url":"https://journalstar.com/news/state-regional/nebraska/article_ae0a958c-bd88-58fc-80b0-21e3a818df71.html"},{"date":"2026-07","event":"Most recent deposit recorded to one of the seven TRON addresses later sanctioned by OFAC (attributed to co-designee Eric Gabriel Cardenas Arzola), per blockchain analytics.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/treasury-sanctions-tren-de-aragua-atm-jackpotting-network-including-seven-tron-addresses"},{"date":"2026-09-13","event":"Canelon Aguirre reportedly captured in Venezuela over the weekend preceding FBI Director Kash Patel's Senate testimony, according to multiple news outlets.","source":"Infobae / Euronews","source_url":"https://www.infobae.com/estados-unidos/2026/09/15/estados-unidos-capturo-en-venezuela-a-uno-de-los-delincuentes-mas-buscados-por-el-fbi-acusado-de-financiar-al-tren-de-aragua/"},{"date":"2026-09-15","event":"FBI Director Kash Patel publicly announced the capture of Canelon Aguirre in Venezuela during testimony before the U.S. Senate Judiciary Committee; reports indicated extradition transport to the U.S. was underway.","source":"Infobae / Latin Times","source_url":"https://www.infobae.com/estados-unidos/2026/09/15/estados-unidos-capturo-en-venezuela-a-uno-de-los-delincuentes-mas-buscados-por-el-fbi-acusado-de-financiar-al-tren-de-aragua/"},{"date":"2026-09-30","event":"OFAC designated Canelon Aguirre and eight other individuals and two Mexico-based entities as Specially Designated Nationals, adding seven TRON wallet addresses to the SDN list. His TRON address TJjRAn9kLiyh8h6gjBjaYjkfDkskgZfyW9 was among the designated assets.","source":"OFAC / Treasury","source_url":"https://ofac.treasury.gov/recent-actions/20260930"}]},"v":1}