Seven TRON addresses sanctioned for alleged Tran de Aragua ATM attack

Trun is again placed on the U.S. sanctions list for suspected ATM hijacking

As the U.S. Treasury Department added seven addresses on the Trun network to the sanctions list, the blockchain is once again involved in U.S. sanctions. The sanctions target so-called ATM hijacking operations linked to the Tren de Aragua criminal group.

Core Points

• Seven Trun addresses that received approximately $6.1 million in funds were added to the U.S. sanctions list for suspected involvement in ATM hijackings organized by Tran de Aragua.
• All seven addresses are hosted by a centralized cryptocurrency exchange, which may allow underlying accounts and associated activities to be identified.
• As of August 2025, U.S. authorities reported losses of US$40.73 million in more than 1,500 suspected hijacking attacks on Tran de Aragua.
• Funds from the sanctioned Trun address have been sent to other wallets associated with the criminal group, and another related network has received approximately $35 million.

According to data from blockchain intelligent analytics company TRM Labs, since March 2022, these seven Trun addresses have received a total of approximately US$6.1 million in inflows. TRM warned that not all funding is directly related to the so-called ATM program.

The addresses were included on the "Specially Designated Nationals and Blocked Persons List"(SDN List) because the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) imposed sanctions on eight individuals and two Mexican-registered companies in the operation. In the same operation, another Tran de Aragua leader accused of involvement in illegal gold mining was also designated for sanctions.

TRM found that all seven Truen addresses were deposit addresses hosted on a centralized cryptocurrency exchange. This means the sanctions are directed at accounts held through virtual asset service providers, rather than self-managed wallets.

Money flow tracking

TRM tracking shows that the largest portion of the $6.1 million went to the Trun address belonging to Eric Gabriel Cardenas Arzola, which received approximately $2.1 million. According to the company's analysis, the activity patterns at the seven addresses are similar: each address receives funds from multiple sources through deposit addresses hosted on a centralized exchange, and most addresses have been dormant for months. The most recent inflow of funds identified by TRM arrived at Cardenas Arzola's address in July 2026.

Funds do not stop at these seven wallets. TRM said the sanctioned addresses had sent cryptocurrencies to other addresses related to Tran de Aragua. The second set of addresses then sent approximately $35 million to a network linked to Jorge Figueira, a Venezuelan national identified by U.S. authorities.

U.S. authorities have charged Figueira with laundering approximately $1 billion. According to TRM, Figueira has not yet been convicted and the charges against him remain indictive.

The latest survey results are similar to another Trunen-based pattern discovered by TRM in September this year. In the Xinbi Guarantee Network, deposit addresses hosted on exchanges are used for settlement, and most of the illegal value is settled through the USDT on the Truen Network. It was previously reported that Tether subsequently froze USDTs totaling US$39.3 million at 10 Truen addresses related to the Xinbi guarantee. TRM has identified Xinbi as one of the largest illegal cryptocurrency markets in Southeast Asia, with transaction volume of approximately US$24.2 billion since 2022.

Treasury Department links Trun wallet to suspected ATM attack

Treasury Department describes the action behind the latest sanctions as an ATM hijacking scheme. This is a cyber attack in which criminals exploit vulnerabilities in ATMs or interactive teller machines to install malware that forces the machines to spit out cash without deducting bank account balances.

According to Treasury sources cited by TRM, such attacks typically involve monitoring target machines before installing malware, and then remotely activating the malware to bypass its security controls. The network operates in Mexico and Venezuela, but the target machines are located in the United States. Stolen funds are allegedly laundered through multiple methods, including cryptocurrency transactions, and then sent to members of Tran de Aragua located in different countries.

As of August 2025, according to the Treasury Department, U.S. losses caused by the suspected Tran de Aragua hijacking attack have reached US$40.73 million, involving more than 1,500 attacks. Since October 21, 2025, the U.S. Department of Justice has indicted 98 people for its alleged role in the ATM hijacking program.

Anibal Alexander Canelon Aguirre, alias "Prometheus", was identified as the main target of the latest operation. The Treasury Department accused Canelon Aguirre of orchestrating the malware used in the attack. Six alleged accomplices were sanctioned with him, and OFAC linked each of the seven individuals to a Trun address.

The defendant faces charges in the Federal District Court of Nebraska, including providing material support to Tran de Aragua, conspiracy to commit bank fraud, conspiracy to commit bank burglary and conspiracy to money laundering. All charges remain in an indictment nature and the defendant is considered innocent unless proven guilty.

Trun still plays an important role in stablecoin transfers

Trun's appearance in the latest sanctions comes at a time when the blockchain handles a large number of USDT activities around the world. In the second quarter, Truen processed USDT transfers worth US$2.1 trillion, bringing its stablecoin market size to a record $89.2 billion. According to data released by Messari in August, USDT supply on the blockchain was US$87.9 billion at the end of the quarter.

The network has appeared several times recently in the latest sanctions and asset freeze cases involving the USDT. In July, OFAC added 131 Trun addresses to the ISIS-K sanctions list, and Chainalysis said Tether subsequently froze the balance at all of those addresses. The wallets have received more than $1.4 million since 2023, and Tether froze the balances after a sanctions update.

Recently, Tether said it helped freeze nearly $550 million in USDT related to Iran in 2026. Four Trun wallets holding more than $130 million were frozen in July operations related to the Central Bank of Iran. Another September case involved $61.2 million in USDT, which U.S. prosecutors are seeking forfeiture. Court records identified 10 Trun addresses where the funds were held, which prosecutors allege were related to sanctioned Iranian oil sales revenue. Tether has frozen all 10 wallets.

Exchange accounts face screening pressure

According to TRM, the latest Tran de Aragua address is different from the self-managed wallet because all seven addresses are deposit addresses hosted on a centralized exchange. As a result, exchanges hosting these addresses may be able to identify the underlying account holders and their associated accounts.

TRM recommends that virtual asset service providers and financial institutions screen these seven Trun addresses and review historical transactions to assess risk exposure. Its analysis recommends extending these checks to indirect counterparties, as funds have been transferred from designated addresses to other wallets associated with Tran de Aragua.

Because the designation was made under Executive Order 13224, foreign financial institutions may face secondary sanctions if they knowingly conduct or facilitate major transactions on behalf of the designated person. Possible measures reportedly include restrictions involving U.S. correspondent banks or payable accounts.

TRM said direct compliance falls on the exchanges hosting the seven addresses and other virtual asset service providers that handle incoming and outgoing funds. The company plans to continue to track activity related to these addresses and the Tran de Aragua financial network.