The United States Treasury Department’s Office of Foreign Assets Control (OFAC) has added seven TRON blockchain addresses to its Specially Designated Nationals and Blocked Persons List, tying them to an alleged ATM jackpotting operation run by the Venezuelan gang Tren de Aragua. The designations were announced on October 1, 2026, and named eight individuals and two Mexico-based companies—Enigma Community and Soluciones Integrales Toluca—alongside the wallet addresses.
According to blockchain intelligence firm TRM Labs, the seven addresses received approximately $6.1 million in total inflows since March 2022. The largest share, about $2.1 million, was linked to Eric Gabriel Cardenas Arzola. U.S. authorities reported that the broader jackpotting campaign caused $40.73 million in losses across more than 1,500 attacks as of August 2025. The Department of Justice has indicted 98 people in related schemes since October 2025, and Anibal Alexander Canelon Aguirre, also known as “Prometheus,” was identified as the alleged malware engineer behind the Ploutus variant used against ATMs.
TRM Labs said all seven sanctioned TRON addresses were deposit addresses hosted at a centralized crypto exchange, rather than self-custody wallets, making it possible for the exchange to identify underlying account holders and connected activity. Funds from these addresses were later sent to other wallets associated with Tren de Aragua, and a second group of wallets moved approximately $35 million to a network tied to Jorge Figueira, a Venezuelan national charged with laundering about $1 billion.
The action is part of a wider OFAC enforcement pattern involving TRON. Earlier designations have included wallets tied to ISIS-K, Hamas, the Houthis, Xinbi Guarantee, and Iranian sanctions evasion networks. Tether has previously frozen USDT across designated addresses, including all 131 TRON wallets in one ISIS-K action. TRON remains a major rail for stablecoin transfers, processing $2.1 trillion in USDT volume in the second quarter, but the latest sanctions underscore continued scrutiny of illicit flows on the network.
Because the designations were made under Executive Order 13224, foreign financial institutions knowingly facilitating significant transactions for designated persons may face secondary sanctions. TRM recommended that virtual asset service providers screen the addresses and review indirect counterparties for potential exposure.
