US Treasury Sanctions Seven TRON Addresses in Tren de Aragua ATM Jackpotting Operation

The US Treasury Department has added seven TRON addresses to its sanctions list, alleging that they were involved in an ATM jackpotting operation tied to Tren de Aragua. The operation is believed to have resulted in $40.73 million in losses across more than 1,500 alleged Tren de Aragua jackpotting attacks as of August 2025. The seven TRON addresses received approximately $6.1 million in total inflows since March 2022, with the largest portion going to an address attributed to Eric Gabriel Cardenas Arzola, which received around $2.1 million.

The Treasury Department described the operation as an ATM jackpotting scheme, where criminals exploit vulnerabilities in ATMs or interactive teller machines and install malware that forces them to dispense cash without debiting a bank account. The network operates from Mexico and Venezuela and targets machines in the United States. Stolen funds are allegedly laundered through several methods, including cryptocurrency transactions, before being sent to Tren de Aragua members in different countries.

The exchange hosting the seven addresses may be able to identify the underlying account holders and accounts connected to them. TRM Labs recommends that virtual asset service providers and financial institutions screen the seven TRON addresses and review historical transactions for exposure. The Treasury Department also warned that foreign financial institutions that knowingly conduct or facilitate a significant transaction on behalf of a designated person may face secondary sanctions.