US Treasury targets TRON addresses linked to ATM jackpotting scheme

Blockchain intelligence firm TRM Labs confirmed that all seven sanctioned wallets were hosted on a centralized cryptocurrency exchange. This structural detail offers investigators a clearer path to identifying the underlying account holders compared to self-custody wallets. The addresses, which received funds starting in March 2022, followed a consistent pattern of pooling deposits before funneling capital toward networks associated with Venezuelan national Jorge Figueira, who currently faces allegations of laundering nearly $1 billion.

Anibal Alexander Canelon Aguirre, identified as the primary engineer behind the malware used in these attacks, remains the central target of the U.S. government’s action. Treasury data indicates that these jackpotting schemes—where criminals remotely force ATMs to dispense cash—have resulted in over $40.73 million in losses across 1,500 incidents as of August 2025. While the defendants face multiple charges in the District of Nebraska, including bank fraud and money laundering conspiracies, they remain innocent until proven guilty in court.

This enforcement action highlights the persistent role of the TRON network in high-volume stablecoin transfers. With USDT activity on the chain reaching trillions in quarterly volume, TRON has become a recurring focal point for regulators. Financial institutions and virtual asset service providers are now tasked with screening these specific addresses and their indirect counterparties to avoid potential secondary sanctions under Executive Order 13224. TRM Labs continues to map the broader financial web as the exchange hosting the flagged accounts works to assist in the identification of connected activity.