US Treasury Sanctions Tren de Aragua Malware Network for $40M ATM Heists

A foreign terrorist organization's ATM malware network has been sanctioned after draining $40.73 million from U.S. banks across over 1,500 jackpotting attacks. The U.S. Department of the Treasury's Office of Foreign Assets Control designated 10 targets tied to a Tren de Aragua fraud scheme and a high-ranking leader on September 30th, 2026.

The network installs malware that forces ATMs to dispense cash, then moves proceeds through cryptocurrency. According to the State Department, TdA was identified as a Foreign Terrorist Organization on February 20th, 2025. Since October 21st, 2025, the Justice Department has indicted 98 people in ATM jackpotting schemes linked to TdA.

Treasury Secretary Scott Bessent stated that the administration will not let terrorist groups exploit the U.S. financial system through theft targeting Americans. 'President Trump's administration will not allow terrorist organizations like Tren de Aragua to exploit the U.S. financial system or enrich themselves through theft and other criminal activity targeting American individuals and businesses.'