OFAC Targets 7 Crypto Wallets Tied to TdA and Prometheus
OFAC links the addresses to Tren de Aragua, ATM fraud, and money laundering routes through centralized exchanges and stablecoins. Tether had already frozen USDT on involved wallets earlier.
Key Takeaways
- OFAC sanctioned 10 targets and 7 crypto addresses that the U.S. says are linked to Tren de Aragua and leader Prometheus.
- According to Treasury, the group used ATM jackpotting as a source of income, with reported U.S. losses of $40.73 million in August 2025.
- The crypto addresses received about $6.1 million in total and were part of money laundering routes that authorities say are tied to larger criminal networks.
OFAC sanctioned 10 targets on Wednesday that the U.S. government says are linked to an ATM jackpotting network run by Tren de Aragua. In the same move, the U.S. Treasury Department also added 7 crypto addresses to the sanctions list that belong to the alleged leader, Anibal Alexander Canelon Aguirre, better known as Prometheus, and his circle.
Jackpotting as a Source of Money
Tren de Aragua is from Venezuela and was designated a Foreign Terrorist Organization by the State Department in February 2025. The Treasury Department says ATM fraud has now become an important source of income for the group.
In jackpotting, malware is used to make ATMs spit out cash without money being taken from an account. Court filings in Nebraska mention the Ploutus malware family, which is said to wipe itself after each attack.
Treasury says Prometheus, who the government says is Anibal Alexander Canelon Aguirre, was the creator of that malware. He is on the FBI Ten Most Wanted list and is also facing criminal charges in Nebraska.
Crypto Addresses and Money Laundering Routes
According to Treasury, the reported U.S. losses from these attacks rose to $40.73 million (€35.9 million) in August 2025, spread across more than 1,500 incidents. That shows how big the damage from this kind of fraud can be, apart from the crypto piece that was supposed to hide the money flows afterward.
TRM Labs says each of the 7 addresses is a deposit address at a centralized crypto exchange. Together, they have received about $6.1 million (€5.4 million) since March 2022, although TRM notes that not all of that money can be directly tied to jackpotting.
The addresses also sent money on to other wallets linked to TdA. Those wallets then moved about $35 million (€30.8 million) to a network that U.S. authorities link to Jorge Figueira, a Venezuelan man suspected of laundering about $1 billion (€0.9 billion).
Chainalysis also says the counterparties of these wallets had exposure to a money laundering network that was also used by Colombian and Mexican cartels. The company calls stablecoins an important part of that infrastructure. Tether had already frozen USDT balances on several wallets that were exposed to the now-sanctioned addresses.
What This Means for Crypto
The case shows how quickly crypto addresses can come into focus when law enforcement tracks money flows around organized crime. For European crypto users, the key point is that OFAC used Executive Order 13224 here, which means foreign financial institutions can face risk if they knowingly process large transactions for sanctioned parties. That makes compliance and screening around wallets and counterparties extra important for crypto exchanges and other financial firms. In other cases too, regulators have shown that crypto infrastructure can come under pressure fast once sanctions or money laundering risks show up, like in the U.S. case involving Binance-linked Iranian oil funds.
