OFAC Blocked Seven Wallets and Counted $6.1 Million. The Cash Left Two Hops Ago

The most-wanted coder behind the cash machines

On 30 September the Treasury's sanctions office designated 10 targets tied to the alleged Tren de Aragua ATM jackpotting scheme, eight people and two Mexico-based companies, plus a gold-mining gang leader sanctioned alongside them ¹. The principal target, Anibal Alexander Canelon Aguirre, known as Prometheus, is the alleged engineer of the jackpotting malware and the first figure on the FBI's Ten Most Wanted list wanted for cybercrime↗ ². Treasury ties the scheme to $40.73 million in reported losses across more than 1,500 US incidents through August 2025 ¹³.

Seven wallets, $6.1 million, one caveat

The crypto leg of the action is seven Tron deposit addresses, one attributed to each named associate and all hosted at a single unnamed centralized exchange ¹⁴. TRM Labs counts about $6.1 million in inflows since March 2022; the largest address took about $2.1 million, and the last inflow landed in July 2026 ¹⁴. TRM's caveat does the honest work: none of that sum is confirmed jackpotting proceeds ¹⁴.

The blacklist stops where the money used to be

The seven addresses were pass-throughs: they forwarded funds to other TdA-linked wallets, and it was those downstream addresses that sent roughly $35 million on to a network US authorities tie to Jorge Figueira, a Venezuelan charged with laundering about $1 billion and not convicted ¹⁴. The blacklist stops at seven strings of characters; the cash keeps moving two hops beyond them.

TRM is advising counterparties to screen exposure one and two hops out, and the threat gives the advice teeth: foreign financial institutions that process significant transactions for the designees risk secondary sanctions ¹²⁴.

The second OFAC action this week priced off a private ledger

This is the second designation in days running on TRM's counts. A screener running TRM Labs data refused more than $50 million of Bitget-theft transfers, and the firm's figures now sit beside OFAC's newest designations, as The Inference reported on 1 October ⁵. Here the addresses, the inflows and the onward hop all carry TRM's attribution ¹⁴; rival Chainalysis drew the wider network, finding the wallets' counterparties exposed to laundering networks used by Colombian and Mexican cartels and Venezuelan launderers, which rely heavily on stablecoins ⁴.

What Treasury holds anyway

The case does not rest on wallet arithmetic: property under US jurisdiction is blocked and US persons are generally barred from dealing with the designees ¹². The published indictment counts disagree. Treasury's announcement puts 98 people indicted since 21 October 2025↗, facing maximum penalties of 20 to 335 years ¹⁶; later reporting puts the running total at 119 ². The longest jackpotting sentence so far, 96 months, came down in August ². Tether has already frozen USDT on wallets exposed to the sanctioned addresses ⁴.

The bill lands on the exchange

Because the addresses are exchange-hosted, the firms running them may identify underlying account holders and related accounts, in TRM's wording, and that is where the screening bill now sits ¹. No report in the record names that host, so the risk is located by role, not by company ¹⁴. The watch ahead is the onward network: Treasury blocked the wallets that fed it, not the network that banked the bigger sums.