Seven TRON addresses sanctioned over alleged Tren de Aragua ATM attacks
The U.S. Treasury has sanctioned seven TRON addresses tied to an alleged ATM jackpotting network linked to Tren de Aragua, the Venezuela-based criminal group. The case shows how TRON and USDT keep turning up in sanctions actions, especially when criminals use exchange-hosted wallets to move and layer dirty funds.
- Seven TRON addresses were added to the U.S. sanctions list.
- TRM Labs said the addresses received about $6.1 million since March 2022.
- All seven were reportedly deposit addresses hosted by a centralized exchange.
- The action fits a broader pattern of TRON and USDT showing up in illicit finance cases.
The Treasury Department’s Office of Foreign Assets Control, better known as OFAC, sanctioned the seven TRON addresses as part of a broader action against an alleged ATM jackpotting operation. Treasury also sanctioned eight individuals and two Mexico-based companies over the network, and separately designated another Tren de Aragua figure accused of involvement in illicit gold mining.
ATM jackpotting is a blunt kind of cyber theft with a blunt result. Criminals use malware or physical tampering to force an ATM or interactive teller machine to spit out cash without proper authorization. In plain English, the machine gets tricked into acting like a very expensive vending machine for thieves.
TRM Labs said the seven TRON addresses collectively received about $6.1 million in inflows since March 2022. TRM also said not all of that money was necessarily tied to the alleged ATM scheme, which matters. On-chain clustering can reveal a lot, but it does not magically turn every linked transfer into a neat confession.
According to TRM, the largest share of the inflows, about $2.1 million, went to a TRON address attributed to Eric Gabriel Cardenas Arzola. TRM also said all seven addresses were deposit addresses hosted by a centralized crypto exchange. That matters because exchange-controlled deposit addresses can be tied back to the underlying account holders if the exchange has usable records.
“The exchange hosting the addresses may therefore be able to identify the underlying account holders and accounts connected to them.”, TRM Labs
That tends to puncture the “crypto is anonymous” fairy tale. Pseudonymous? Often. Untraceable? Not even close, especially when a centralized exchange sits in the middle and keeps the receipts.
The main target of the latest action was identified as Anibal Alexander Canelon Aguirre, known as “Prometheus.” Treasury alleges that he engineered the malware used in the attacks. Six alleged associates were designated alongside him, bringing the total number of people linked to the seven TRON addresses to seven.
The defendants face charges in the U.S. District Court for the District of Nebraska, including providing material support to Tren de Aragua, bank fraud conspiracy, bank burglary conspiracy, and money laundering conspiracy. As always, those are allegations, and the defendants are presumed innocent unless proven guilty. Prosecutors still have to do the boring little thing called evidence in court.
Funds from the sanctioned addresses were reportedly sent onward to other addresses associated with Tren de Aragua. TRM also said a second group of addresses later sent approximately $35 million to a network affiliated with Venezuelan national Jorge Figueira. U.S. authorities have charged Figueira with laundering about $1 billion in illicit funds.
Why TRON keeps turning up in sanctions cases
TRON is not accused of creating these crimes. But it keeps showing up in the plumbing because it is a cheap, fast network for moving USDT, and bad actors love cheap and fast almost as much as legitimate users do.
According to Messari data published in August, TRON processed $2.1 trillion in USDT transfers during the second quarter. TRON’s stablecoin market reached a record $89.2 billion, and USDT supply on TRON ended the quarter at $87.9 billion. Those are huge numbers, and they explain why the chain is hard to ignore in any serious discussion of stablecoin settlement.
TRM Labs said, “The latest findings resemble another TRON based pattern TRM identified in September.” That lines up with a familiar pattern. High-volume USDT activity on TRON keeps showing up in enforcement actions, freeze events, and sanctions designations. The network itself is not the crime, but it is clearly a favored rail for moving suspect money quickly.
That is the uncomfortable truth for the industry. The same properties that make TRON useful for ordinary settlement, speed, liquidity, low fees, also make it attractive for laundering, sanctions evasion, and other nonsense that gives compliance teams headaches and regulators a target to point at.
The broader enforcement picture is already crowded
This latest designation is part of a much wider crackdown. In July, OFAC added 131 TRON addresses to its ISIS-K designation. Chainalysis later said Tether froze balances across all 131 addresses, which had received more than $1.4 million since 2023.
The sanctions pressure has also extended to Iran-linked flows. In a separate September case, U.S. prosecutors sought to forfeit $61.2 million in USDT tied to 10 TRON addresses. Court records said those funds were linked to proceeds from sanctioned Iranian oil sales, and Tether froze all 10 wallets. In another July action, four TRON wallets holding more than $130 million were also frozen in a case tied to the Central Bank of Iran.
Tether has also said it helped freeze nearly $550 million in Iran-linked USDT in 2026. That is the part many people in crypto still try to hand-wave away. Stablecoins are not just bearer assets floating in a decentralized void. In practice, issuer controls, exchange custody, and compliance cooperation can make them surprisingly easy to freeze when the pressure is there.
Because these designations were made under Executive Order 13224, foreign financial institutions that knowingly facilitate significant transactions for designated persons may face secondary sanctions. That risk reaches far beyond crypto-native firms. Banks, OTC desks, payment companies, and exchanges that think they are safely outside the blast radius often find out they are not.
What this says about Tren de Aragua
Tren de Aragua is a transnational criminal organization that expanded beyond Venezuela and built out a presence across parts of Latin America. The important thing is that groups like this are rarely tidy hierarchies. They are often dispersed, adaptive, and messy, with cells, couriers, and laundering partners moving in and out of the picture.
That makes enforcement a mixed bag. It is easier to trace fragments when money moves through centralized rails. It is harder to shut down the whole machine, because these networks reroute quickly. Cut off one wallet, one exchange account, or one mule, and another tends to pop up somewhere else with a fresh haircut and the same bad intentions.
So the real question is not whether one sanctions action “solves” the problem. It does not. The better question is whether enforcement can keep making these rails more expensive and more annoying for criminals to use than the next best alternative. That is where exchange records, stablecoin freezes, and wallet attribution start to matter.
Key takeaways
-
Why does this matter for crypto users?
Because it shows how stablecoins on fast chains like TRON sit at the center of the compliance fight. The same rails that make payments efficient also make illicit transfers easier when controls are weak. -
Does this prove TRON is criminal infrastructure?
No. It shows TRON is widely used for USDT transfers and is attractive to bad actors because it is cheap and fast. That is a usage problem, not proof that the chain itself is the crime. -
Why do exchange-hosted deposit addresses matter?
Because they can connect blockchain activity to real accounts if the exchange has good records. That gives investigators a route from pseudonymous wallets to identifiable users. -
Can sanctions actually freeze crypto?
Sometimes, yes. Freezes usually affect custodial or issuer-controlled assets, not every coin on a blockchain. But when exchanges or issuers cooperate, sanctioned funds can be locked down quickly. -
Is the full $6.1 million definitely tied to the ATM attacks?
Not necessarily. TRM Labs said not all of the funds were necessarily connected to the alleged scheme, so the total should not be read as a clean count of jackpotting proceeds.
There is a blunt lesson here: stablecoins are one of crypto’s most useful inventions, and also one of its most abusable. They are excellent for settlement, remittances, and trading, and equally useful for moving bad money across borders at speed. Pretending otherwise is just market theater with extra steps.
Expect more sanctions, more freezes, and more attempts to route around both.
Further reading
A few related pieces worth keeping on the radar:
- Tether freezes 131 TRON wallets in an ISIS-K-linked case
- Reggie Fowler coverage and background
- Aerodrome's tokenized stock pools draw $103 million in volume
- US court overturns OFAC sanctions on Tornado Cash
- Stablecoin Wars 2025: Tether USDT vs Circle USDC and new rivals
- U.S. sanctions Xinbi crypto marketplace in sweeping crackdown
