Venezuelan Man Accused of ATM Hacking Brought to U.S.

A Venezuelan man, linked to a large-scale ATM hacking operation, has been apprehended and extradited to the United States to face federal charges, according to the Justice Department. Anibal Alexander Canelon Aguirre, aged 50, known by aliases “Prometheus” and “The Engineer,” faces accusations of being a senior leader in an international conspiracy that involved using malicious software to manipulate ATMs to dispense cash. This operation reportedly generated funds for the Tren de Aragua, a notorious crime syndicate from Venezuela.

On October 2, Canelon Aguirre appeared before U.S. Magistrate Judge Michael D. Nelson in Nebraska and pleaded not guilty to four counts. He remains detained in Nebraska, awaiting trial. Efforts to reach Canelon Aguirre’s legal team and the FBI for comments were not successful as of the time of publication.

Tren de Aragua initially began as a prison gang in Venezuela and expanded its operations across the Western Hemisphere. U.S. authorities have connected this organization to various criminal activities such as drug and firearms trafficking, kidnapping, fraud, extortion, and violent crimes. The organization was classified as a foreign terrorist organization by the Trump administration in February 2025.

“Anibal Canelon Aguirre served as a key architect of sophisticated malware used to drain ATMs of cash across the United States — technology that helped fuel the criminal operations of the violent transnational organization Tren de Aragua,” commented Assistant Attorney General A. Tysen Duva, from the Justice Department’s Criminal Division, in a press release.

Canelon Aguirre is on the FBI’s Most Wanted Fugitives list, appointed there in March 2026 as the 540th person and the first alleged cybercriminal to receive this designation.

The Justice Department has yet to disclose the exact location where Canelon Aguirre was captured. A federal grand jury in Nebraska indicted him in December 2025. He faces charges of conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, conspiracy to engage in money laundering, and conspiracy to provide material support to terrorists.

The FBI indicates that Canelon Aguirre led a global conspiracy that dispatched teams to the U.S. to steal millions from financial institutions, allegedly supporting Tren de Aragua’s operations. The scheme has reportedly been in operation since at least January 2024. Prosecutors allege he created Ploutus malware, which facilitated “ATM jackpotting” attacks, wherein malware causes ATMs to output money without affecting bank accounts. It is claimed the malware was also designed to thwart forensic analysis and allow for self-deletion to avoid detection.

The conspiracy targeting ATM jackpotting attacks spanned 47 states, Washington D.C., and several international sites, resulting in charges against 120 individuals in Nebraska related to the conspiracy. Three have already been sentenced: Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padron, each receiving 78 months, and Juan Manuel Gouveia Aguilera sentenced to 96 months.

FBI Director Kash Patel highlighted Canelon Aguirre’s capture as the 10th successful apprehension of a fugitive on the FBI’s Ten Most Wanted list since the start of the Trump administration. The FBI’s process of managing the Ten Most Wanted list has been scrutinized, with reports suggesting the timing of additions to the list may have skewed public perception of their success rate. The FBI has refuted any claims of improper data practices.