Seven TRON addresses sanctioned over alleged Tren de Aragua ATM attacks

cryptonews

Oct 01

TRON has been pulled into another U.S. sanctions action after the Treasury Department added seven addresses on the network to its sanctions list over an alleged ATM jackpotting operation tied to Tren ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Most Discussed

{"basename":"","ssrTDKData":{"titleTemplate":"%s - Tiger Brokers","title":"Tiger Brokers HK | Online Trading in stocks, bonds & ETFS","description":"Discover Tiger Brokers HK, an online trading platform for stocks&ETFs, options&futures, bonds and crypto. Open an account to enjoy low commission trading today!","keywords":"tiger trading,tiger security,tiger broker hk,tigers co ltd,tiger trade hk,tiger brokers hk,stock broker,securities broker,online brokerage,hong kong broker,hk broker,online stock trading,online trading platform,stock trading platforms,trading application,stock trading,stock trading hong kong,buying stocks in hong kong,tiger brokers","social":{"ogDescription":"Discover Tiger Brokers HK, an online trading platform for stocks&ETFs, options&futures, bonds and crypto. Open an account to enjoy low commission trading today!","ogImage":"https://c1.itigergrowtha.com/portal5/static/media/og-logo.0a0bd8dc.png","ogUrl":"https://hk.tigershowtime.com/news/2672738758"},"companyName":"Tiger Brokers"},"pageData":{"isMobile":false,"isTiger":false,"isTTM":true,"region":"HKG","license":"TBHK","edition":"fundamental"},"isCrawlerRequest":true,"__swrFallback__":{"@#url:\"https://stock-news.skytigris.cn/v3/news\",params:#id:\"2672738758\",edition:\"fundamental\",auth_exemption:1,,,undefined,":{"share":"https://ttm.financial/m/news/2672738758?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-10-01 16:15","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2672738758","market":"us","top_or_hot":-1,"title":"Seven TRON addresses sanctioned over alleged Tren de Aragua ATM attacks","media":"cryptonews","content":"<div>\n<p>TRON has been pulled into another U.S. sanctions action after the Treasury Department added seven addresses on the network to its sanctions list over an alleged ATM jackpotting operation tied to Tren ...</p>\n\n<a href=\"https://crypto.news/seven-tron-addresses-sanctioned-over-alleged-tren-de-aragua-atm-attacks/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Seven TRON addresses sanctioned over alleged Tren de Aragua ATM attacks</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nSeven TRON addresses sanctioned over alleged Tren de Aragua ATM attacks\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-10-01 16:15 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/seven-tron-addresses-sanctioned-over-alleged-tren-de-aragua-atm-attacks/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>TRON has been pulled into another U.S. sanctions action after the Treasury Department added seven addresses on the network to its sanctions list over an alleged ATM jackpotting operation tied to Tren ...</p>\n\n<a href=\"https://crypto.news/seven-tron-addresses-sanctioned-over-alleged-tren-de-aragua-atm-attacks/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"NSI","symbol_name":"NATIONAL SECURITY EMERGING MARKETS INDEX ETF","start_time":0,"source_url":"https://crypto.news/seven-tron-addresses-sanctioned-over-alleged-tren-de-aragua-atm-attacks/","article_id":"2672738758","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/seven-tron-addresses-sanctioned-over-alleged-tren-de-aragua-atm-attacks/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2672738758","pubTimestamp":1790842540,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"TRON has been pulled into another U.S. sanctions action after the Treasury Department added seven addresses on the network to its sanctions list over an alleged ATM jackpotting operation tied to Tren de Aragua.Seven TRON addresses that received about $6.1 million were added to the U.S. sanctions list over an alleged Tren de Aragua ATM jackpotting operation.All seven addresses were hosted by a centralized crypto exchange, potentially allowing the underlying accounts and connected activity to be identified.U.S. authorities reported $40.73 million in losses across more than 1,500 alleged Tren de Aragua jackpotting attacks as of August 2025.Funds from the sanctioned TRON addresses were sent to other wallets associated with Tren de Aragua, with another connected network receiving about $35 million.According to TRM Labs, the seven TRON addresses received approximately $6.1 million in total inflows since March 2022. The blockchain intelligence firm cautioned that not all of the funds were nec","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"NSI":"NATIONAL SECURITY EMERGING MARKETS INDEX ETF","BKCH":"AdvisorShares Sabretooth ETF"},"translate_title":"七个 TRON 地址因涉嫌 Tren de Aragua ATM 攻击而受到制裁","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"NSI":0.9,"BKCH":0.65},"content_text":"TRON has been pulled into another U.S. sanctions action after the Treasury Department added seven addresses on the network to its sanctions list over an alleged ATM jackpotting operation tied to Tren de Aragua.\n\n\nSummary\n\n\n\nSeven TRON addresses that received about $6.1 million were added to the U.S. sanctions list over an alleged Tren de Aragua ATM jackpotting operation.\nAll seven addresses were hosted by a centralized crypto exchange, potentially allowing the underlying accounts and connected activity to be identified.\nU.S. authorities reported $40.73 million in losses across more than 1,500 alleged Tren de Aragua jackpotting attacks as of August 2025.\nFunds from the sanctioned TRON addresses were sent to other wallets associated with Tren de Aragua, with another connected network receiving about $35 million.\n\n\n\nAccording to TRM Labs, the seven TRON addresses received approximately $6.1 million in total inflows since March 2022. The blockchain intelligence firm cautioned that not all of the funds were necessarily connected to the alleged ATM scheme.\nThe addresses were added to the Specially Designated Nationals and Blocked Persons List as the U.S. Treasury’s Office of Foreign Assets Control sanctioned eight individuals and two Mexico based companies over the operation. A separate Tren de Aragua leader accused by Treasury of involvement in illicit gold mining was designated in the same action.\nTRM found that all seven TRON addresses were deposit addresses hosted by a centralized crypto exchange, giving the sanctions action a direct link to accounts held through a virtual asset service provider instead of self custody wallets.\nSeven TRON addresses received $6.1 million\nTRM traced the largest portion of the $6.1 million to the TRON address attributed to Eric Gabriel Cardenas Arzola, which received approximately $2.1 million.\nAccording to the firm’s analysis, activity across the seven addresses followed a similar pattern. Each received funds from numerous sources through deposit addresses hosted at a centralized exchange, while most have remained dormant for months. The most recent inflow identified by TRM went to the address attributed to Cardenas Arzola in July 2026.\nFunds did not stop at the seven wallets. TRM said the sanctioned addresses sent cryptocurrency to other addresses associated with Tren de Aragua. The second group of addresses subsequently sent approximately $35 million to a network that U.S. authorities have affiliated with Venezuelan national Jorge Figueira.\nU.S. authorities have charged Figueira with laundering approximately $1 billion in illicit funds. According to TRM, Figueira has not been convicted and the charges against him remain allegations.\nThe latest findings resemble another TRON based pattern TRM identified in September. Exchange hosted deposit addresses were used in the Xinbi Guarantee network, where illicit value largely settled through USDT on TRON.\nTether subsequently froze $39.3 million in USDT across 10 TRON addresses linked to Xinbi Guarantee, crypto.news previously reported. TRM had identified Xinbi as one of Southeast Asia’s largest illicit crypto marketplaces, with approximately $24.2 billion in transactions since 2022.\nTreasury ties TRON wallets to alleged ATM attacks\nTreasury described the operation behind the latest sanctions as an ATM jackpotting scheme, a cyberattack in which criminals exploit vulnerabilities in ATMs or interactive teller machines and install malware that forces them to dispense cash without debiting a bank account.\nAccording to the Treasury account cited by TRM, the attacks typically involve monitoring a targeted machine before malware is installed and remotely activated to bypass its security controls. The network operates from Mexico and Venezuela while targeting machines in the United States. Stolen funds are allegedly laundered through several methods, including cryptocurrency transactions, before being sent to Tren de Aragua members in different countries.\nReported U.S. losses from alleged Tren de Aragua jackpotting attacks reached $40.73 million across more than 1,500 attacks as of August 2025, according to Treasury. Since Oct. 21, 2025, the Department of Justice has indicted 98 people over their alleged roles in ATM jackpotting schemes.\nAnibal Alexander Canelon Aguirre, known as “Prometheus,” was identified as the main target of the latest action. Treasury alleges Canelon Aguirre engineered the malware used in the attacks. Six alleged associates were designated alongside him, with OFAC linking each of the seven individuals to one of the TRON addresses.\nThe defendants face charges in the U.S. District Court for the District of Nebraska that include providing material support to Tren de Aragua, bank fraud conspiracy, bank burglary conspiracy and money laundering conspiracy. All charges remain allegations, and the defendants are presumed innocent unless proven guilty.\nTRON remains prominent in stablecoin transfers\nTRON’s appearance in the latest sanctions action comes as the blockchain handles a large share of global USDT activity.\nDuring the second quarter, TRON processed $2.1 trillion in USDT transfers while its stablecoin market reached a record $89.2 billion. USDT supply on the blockchain ended the quarter at $87.9 billion, according to Messari data published in August.\nThe network has repeatedly appeared in recent sanctions and asset freeze cases involving USDT. OFAC added 131 TRON addresses to its ISIS K designation in July, with Chainalysis saying Tether subsequently froze balances across all of the addresses. The wallets had received more than $1.4 million since 2023, while Tether froze the balances following the sanctions update.\nMore recently, Tether said it had helped freeze nearly $550 million in Iran linked USDT during 2026. Four TRON wallets holding more than $130 million were frozen in a July action tied to the Central Bank of Iran.\nA separate September case involved $61.2 million in USDT that U.S. prosecutors are seeking to forfeit. Court records identified 10 TRON addresses holding the funds, which prosecutors alleged were connected to proceeds from sanctioned Iranian oil sales. Tether had frozen all 10 wallets.\nExchange accounts face screening after TRON sanctions\nAccording to TRM, the latest Tren de Aragua addresses differ from self custody wallets because all seven are deposit addresses hosted at a centralized exchange. The exchange hosting the addresses may therefore be able to identify the underlying account holders and accounts connected to them.\nTRM said virtual asset service providers and financial institutions should screen the seven TRON addresses and review historical transactions for exposure. Its analysis recommended extending those checks to indirect counterparties because funds moved from the designated addresses to other wallets associated with Tren de Aragua.\nSince the designations were made under Executive Order 13224, foreign financial institutions that knowingly conduct or facilitate a significant transaction on behalf of a designated person may face secondary sanctions. According to the report, possible measures include restrictions involving U.S. correspondent or payable through accounts.\nThe immediate compliance work falls on the exchange hosting the seven addresses and other virtual asset service providers that processed funds moving to or from them, TRM said. The firm plans to continue tracking activity connected to the addresses and Tren de Aragua’s financial network.\n\n\n\n\n\n                Read more:\n            \n\n                India beats Singapore and Australia in centralized crypto exchange inflows","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"-1","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"}}}