BTC $83,672 
ETH $2,687 
USDT $0.9998 
BNB $768.51 
XRP $1.48 
USDC $0.9999 
SOL $117.50 
TRX $0.3328 
FIGR_HELOC $1.03 
ZEC $1,393 Seven TRON addresses sanctioned over alleged Tren de Aragua ATM attacks
OFAC added seven TRON addresses to its sanctions list over an alleged Tren de Aragua ATM jackpotting operation, and TRM Labs traced about $6.1 million.
Key takeaways
- Seven addresses, $6.1 million. TRM Labs traced approximately $6.1 million in inflows to the seven sanctioned TRON addresses since March 2022.
- Deposit addresses at an exchange. All seven addresses were deposit addresses hosted by a centralized crypto exchange, TRM found.
- Losses reach $40.73 million. U.S. authorities reported $40.73 million in losses across more than 1,500 alleged attacks as of August 2025.
What happened
The U.S. Treasury's Office of Foreign Assets Control added seven TRON addresses to the Specially Designated Nationals and Blocked Persons List over an alleged ATM jackpotting operation tied to Tren de Aragua. OFAC designated 10 targets tied to the scheme on September 30, 2026, and Treasury sanctioned eight individuals and two Mexico-based companies.
TRM Labs traced approximately $6.1 million in total inflows to the seven addresses since March 2022. All seven were deposit addresses hosted by a centralized crypto exchange, which links the action to accounts held through a virtual asset service provider instead of self-custody wallets.
TRM traced the largest portion, about $2.1 million, to an address attributed to Eric Gabriel Cardenas Arzola. The sanctioned addresses also sent cryptocurrency to other wallets associated with Tren de Aragua, and a second group sent approximately $35 million to a network U.S. authorities have affiliated with Jorge Figueira, who authorities have charged with laundering approximately $1 billion in illicit funds.
Why it matters
The sanctions reach accounts held at a centralized exchange rather than self-custody wallets. Because the addresses were exchange-hosted deposit addresses, the underlying accounts and connected activity could potentially be identified.
U.S. authorities reported $40.73 million in losses across more than 1,500 alleged Tren de Aragua jackpotting attacks as of August 2025. The Justice Department has indicted 98 people in ATM jackpotting schemes linked to the group since October 21, 2025.
Treasury Secretary Scott Bessent said the administration will not allow terrorist organizations to exploit the U.S. financial system.
What the data shows
- TRM Labs says the seven addresses received approximately $6.1 million in total inflows since March 2022.
- The Daily Hodl put the amount drained from U.S. banks at $40,730,000 across more than 1,500 attacks.
Background
- The State Department identified TdA as a Foreign Terrorist Organization on February 20, 2025.
What is still unclear
- TRM cautioned that not all of the funds received by the seven addresses were necessarily connected to the alleged ATM scheme.
- TRM said Jorge Figueira has not been convicted and the charges against him remain allegations.
Questions readers ask
Which TRON addresses did the U.S. Treasury sanction?
OFAC added seven TRON addresses to the Specially Designated Nationals and Blocked Persons List over an alleged Tren de Aragua ATM jackpotting operation. Treasury also sanctioned eight individuals and two Mexico-based companies.
How much did the sanctioned addresses receive?
TRM Labs says the seven addresses received approximately $6.1 million in total inflows since March 2022. All seven were deposit addresses hosted by a centralized crypto exchange.
What is ATM jackpotting?
The Daily Hodl describes a network that installs malware forcing ATMs to dispense cash, then moves proceeds including through cryptocurrency. Losses reached $40.73 million as of August 2025.
