U.S. Treasury Sanctions TRON Addresses
The U.S. Treasury Department has taken significant action against the cryptocurrency network TRON by adding seven of its addresses to its sanctions registry. This move is tied to an alleged ATM jackpotting operation linked to the criminal group Tren de Aragua. Recent analysis from TRM Labs revealed that these seven addresses collectively accounted for inflows totaling around $6.1 million since March 2022; however, the firm warned that not all of these transactions are necessarily related to the accusing ATM operation.
Details of the Sanctioned Addresses
These addresses have been identified in the Specially Designated Nationals and Blocked Persons List (SDN), coinciding with broader sanctions targeting eight individuals and two companies located in Mexico, believed to be associated with the ATM jackpotting activities. Notably, one of the leaders from Tren de Aragua also faces allegations of being linked to illicit gold mining operations.
TRM Labs has confirmed that all seven sanctioned addresses function as deposit addresses facilitated by a centralized cryptocurrency exchange. This indicates a direct connection to accounts managed through a virtual asset service provider rather than being self-custody wallets. Further analysis pinpointed a significant portion of the funds, approximately $2.1 million, directed into a TRON address linked to Eric Gabriel Cardenas Arzola.
Transaction Patterns and Connections
The transactions at these TRON addresses showed a consistent pattern, where funds were received from diverse sources through exchange-hosted deposit addresses, but most have not been active for months. The last recorded incoming transaction dated back to July 2026, directed to Cardenas Arzola’s address. However, the trail of the cryptocurrency did not end with the seven wallets; they also transferred funds to other addresses associated with Tren de Aragua, which ultimately sent around $35 million to another network believed to be linked to Jorge Figueira, a Venezuelan national charged with laundering around $1 billion in illicit funds. It’s important to note that Figueira has not been convicted, and the charges against him remain unproven allegations.
Previous Investigations and Patterns
These developments echo a previous investigation by TRM that uncovered a similar pattern involving TRON addresses used in another illicit network, known as Xinbi Guarantee. Tether, the company behind the USDT stablecoin, previously froze $39.3 million in USDT from 10 TRON addresses associated with this network, which is infamous for facilitating sizable illicit transactions throughout Southeast Asia.
ATM Jackpotting Scheme
As the Treasury outlined, the alleged ATM jackpotting scheme consists of sophisticated cyberattacks enabling criminals to exploit vulnerabilities in Automatic Teller Machines (ATMs). This often involves observing these machines before malware is deployed to override their security measures, allowing for unauthorized cash withdrawals. The scheme reportedly operates primarily out of Mexico and Venezuela, targeting ATMs in the U.S., where stolen funds are subsequently laundered through various methods, including cryptocurrency.
Reported losses attributed to this jackpotting operation exceed $40 million across over 1,500 incidents as of August 2025. The Department of Justice stated that, since that report, 98 individuals have been indicted for their involvement in such schemes. The focus of the latest action has been Anibal Alexander Canelon Aguirre, also known as “Prometheus,” accused of developing the malware utilized in these attacks, alongside six alleged accomplices connected to the sanctioned TRON addresses.
Legal Proceedings and Implications
All accused individuals face a variety of serious charges in the U.S. District Court for the District of Nebraska, which range from bank fraud conspiracy to money laundering. As with all legal proceedings, these allegations are presumed innocent until proven guilty.
Impact on TRON and Future Actions
TRON’s inclusion in this sanctions action is notable given its role in global USDT transactions. In the second quarter, TRON facilitated $2.1 trillion in USDT transfers and has seen its stablecoin market flourish with a peak of $89.2 billion. The ongoing scrutiny comes in the wake of previous sanctions, including the addition of 131 TRON addresses in relation to terrorist financing, as well as actions taken against wallets linked to Iranian financial misconduct.
In conclusion, TRM Labs stressed that financial institutions and virtual asset service providers should exercise heightened due diligence concerning the seven sanctioned TRON addresses, reviewing transaction histories and potential connections to these criminal activities. The exchange managing these addresses may have further obligations to investigate and identify account holders connected to these transactions, given the potential for secondary sanctions under Executive Order 13224 if significant transactions are found to be knowingly facilitated for designated individuals.
