- Anibal Alexander Canelon Aguirre, a 49-year-old Venezuelan national, is the alleged mastermind behind a massive international ATM jackpotting conspiracy that has drained millions from U.S. financial institutions.
- The scheme used sophisticated malware to force ATMs to dispense cash on command — and the stolen funds were funneled directly to Tren de Aragua, a designated foreign terrorist organization.
- Canelon Aguirre is now on the FBI’s Ten Most Wanted Fugitives list — the first cybercriminal ever added for ATM-related offenses — with a reward of up to $1 million for information leading to his arrest.
- A federal grand jury in Nebraska indicted dozens of people connected to this scheme, with crews deployed across the U.S. to physically install malware on ATM machines.
- Keep reading to understand exactly how the ATM jackpotting technique works, how cash was laundered, and what charges Canelon Aguirre now faces.
A Venezuelan cybercriminal is at the center of one of the most sophisticated ATM theft operations ever prosecuted on U.S. soil.
Anibal Alexander Canelon Aguirre, 49, allegedly engineered a sprawling international conspiracy that combined cutting-edge malware, organized criminal crews, and a complex money-laundering pipeline — all while operating from abroad. The FBI Omaha Field Office, which has been tracking this case for months, announced his placement on the Ten Most Wanted Fugitives list in March 2026. Crime investigators and news followers tracking this case should understand the full scope of what federal authorities have uncovered.
FBI’s Most Wanted: Who Is Anibal Alexander Canelon Aguirre?
Canelon Aguirre is a 49-year-old Venezuelan national accused of leading a large-scale ATM jackpotting conspiracy that targeted federally insured banks across the United States. According to the FBI, he served as the technical architect of the entire operation — designing and deploying the malware that made mass, unauthorized ATM cash withdrawals possible.
What makes his case historically significant is the distinction he now holds: the FBI’s Special Agent Kowel confirmed that Canelon Aguirre is the first person ever accused of cybercrimes to be placed on the Ten Most Wanted Fugitives list. That’s not a minor footnote — it signals how seriously federal law enforcement is treating ATM-based cybercrime as a national security threat.
Beyond the financial crimes, the FBI has stated that Canelon Aguirre is considered armed and dangerous and is allegedly using stolen funds to support a foreign terrorist organization. His ties span Venezuela and Mexico, and he is known to communicate exclusively in Spanish.
Known Aliases: “Prometheus” and “The Engineer”
Canelon Aguirre operates under two notable aliases: “Prometheus” and “The Engineer.” These names aren’t incidental — they reflect his role as the technical mind behind the malware infrastructure that powered the entire jackpotting network. He reportedly developed and maintained the malicious software used to compromise ATMs across multiple states.
Physical Description and Last Known Location
According to the FBI, Canelon Aguirre stands between 5 feet 5 inches and 5 feet 7 inches tall, weighs approximately 190 pounds, and has black and gray hair. He has known ties to both Venezuela and Mexico and is believed to be operating outside the United States. He speaks Spanish and has managed to evade capture despite the sweeping federal investigation that has already resulted in dozens of arrests.
Federal Arrest Warrant Issued December 9, 2025
A federal arrest warrant for Canelon Aguirre was issued on December 9, 2025, following a federal grand jury indictment out of Nebraska. The indictment came after investigators had been tracking the jackpotting network for months, building a case that ultimately implicated dozens of individuals operating as on-the-ground crews across the country. The warrant covers multiple serious federal charges, which will be detailed later in this article.
What Is ATM Jackpotting and How Did This Scheme Work?
ATM jackpotting is a cyberattack method where criminals install malware — or sometimes specialized hardware — directly onto an ATM’s internal systems, forcing the machine to dispense cash as if it had “hit the jackpot.” Unlike card skimming, which steals data to clone cards, jackpotting attacks the ATM itself, turning it into an on-demand cash dispenser for criminals.
The scheme allegedly run by Canelon Aguirre went far beyond a simple smash-and-grab operation. It was a coordinated, multi-layered criminal enterprise with distinct roles: a remote technical operator, physical crews deployed to install malware, and a money-laundering network to move the stolen cash.
How Malware Forces ATMs to Dispense Cash
In this type of attack, crews physically access the internal components of an ATM — often by disguising themselves as technicians — and install malware directly onto the machine’s operating system. Once the malicious software is loaded, it can be triggered remotely or via a connected device to override the ATM’s normal cash-dispensing controls. The machine then ejects cash in rapid succession, completely bypassing standard withdrawal limits and account verification processes. This is what federal prosecutors described when detailing how Canelon Aguirre’s malware was deployed against federally insured banks starting at least as early as January 2024.
How Canelon Aguirre Operated Remotely From Venezuela
One of the most alarming aspects of this case is that Canelon Aguirre allegedly orchestrated the entire operation without setting foot in the United States. Operating from Venezuela, he reportedly developed and distributed the malware used by crews deployed domestically, functioning as a remote command center for the conspiracy. This remote-operation model is increasingly common in international cybercrime, but the scale and coordination here — combined with direct links to a terrorist organization — pushed this case onto the FBI’s highest-priority fugitive list.
How Stolen Cash Was Laundered Through a Complex Network
Once ATMs were forced to dispense cash, the money didn’t simply disappear into criminals’ pockets — it moved through a carefully structured laundering pipeline. According to the FBI, the stolen funds were funneled through a complex network specifically designed to obscure their origin and move money internationally. This layered approach is a hallmark of sophisticated transnational criminal organizations, not street-level theft rings.
The laundering process reportedly involved multiple individuals acting as money mules, transferring cash through various channels before it reached its final destination. This type of structuring — breaking up large sums into smaller, less traceable transactions — is a federal crime in itself, which is why conspiracy to commit money laundering is one of the specific charges Canelon Aguirre faces. In a related effort, Interpol’s Operation Synergia III has been instrumental in shutting down malicious operations and arresting individuals involved in similar criminal activities globally.
What makes this laundering network especially alarming is where the money ultimately ended up: directly funding the operations of Tren de Aragua, a Venezuelan gang that the U.S. government has formally designated as a foreign terrorist organization. The ATM jackpotting scheme wasn’t just bank robbery — it was, according to federal prosecutors, an active terrorism financing operation.
The Tren de Aragua Connection
The financial thread connecting stolen ATM cash to a foreign terrorist organization is what elevated this case from a major cybercrime investigation to a national security matter. Tren de Aragua, also known as TdA, sits at the center of that connection — and understanding who they are makes the gravity of this conspiracy much clearer.
Why Tren de Aragua Is Classified as a Foreign Terrorist Organization
Tren de Aragua originated in Venezuela, growing out of the Tocorón prison in Aragua state before expanding into one of Latin America’s most dangerous and far-reaching criminal organizations. The gang is known for extreme violence, human trafficking, extortion, and drug smuggling, with a presence that has now spread across multiple countries including the United States. The Trump administration designated Tren de Aragua as a foreign terrorist organization, a classification that carries serious legal consequences for anyone providing them material support — including money.
That designation is precisely why the ATM jackpotting conspiracy carries charges that go beyond bank fraud. Funneling stolen money to a designated terrorist organization triggers federal material support statutes, which is reflected directly in the charges Canelon Aguirre faces. The FBI has been explicit: this isn’t just organized crime — it’s terrorism financing.
How ATM Theft Funded the Gang’s Operations
According to the FBI, Canelon Aguirre is described as the “alleged mastermind behind the malware that Tren de Aragua deployed against federally insured banks across the country.” This framing is significant — it positions the ATM jackpotting operation not as a side hustle but as a deliberate, organized revenue stream for the gang’s broader criminal enterprise. The stolen cash provided operational funding that supported TdA’s activities both inside and outside the United States.
Crews sent into the U.S. to physically install malware on ATMs were reportedly connected to Tren de Aragua’s network, meaning the gang handled both the technical and ground-level sides of the operation. The result was a vertically integrated criminal enterprise: malware development in Venezuela, deployment across American cities, and proceeds flowing back to fund further terrorist activity.
Scale of the Operation: By the Numbers
To understand just how large this conspiracy grew, the raw numbers tell the story more clearly than any description. Federal investigators have been building this case since at least early 2024, and by the time the most recent indictments dropped, the scope had expanded to include dozens of defendants across multiple states.
Over 700 Jackpotting Incidents Recorded in 2025
ATM jackpotting incidents surged significantly in 2025, with the FBI tracking over 700 separate jackpotting incidents across the United States during that period. The scale of these incidents points to an organized, well-resourced operation rather than isolated criminal activity — crews were being deployed systematically across the country, hitting financial institutions in multiple states.
More Than $20 Million in Losses to U.S. Financial Institutions
The financial damage inflicted on U.S. banks and federally insured financial institutions runs into the tens of millions. Investigators have linked more than $20 million in losses directly to the jackpotting conspiracy, though the full financial impact may be higher as the investigation continues to develop.
To put the scale of this operation in perspective, here is a breakdown of what federal authorities have documented so far:
Detail Figures Operation Start Date At least January 2024 Jackpotting Incidents (2025) 700+ Estimated Financial Losses $20 million+ FBI Reward for Canelon Aguirre Up to $1 million Federal Arrest Warrant Issued December 9, 2025 Added to Ten Most Wanted List March 2026
These figures represent only what has been confirmed through federal court filings and FBI statements. Investigators have indicated the conspiracy affected financial institutions across numerous states, meaning the true reach of the operation is still being mapped as new defendants are identified and prosecuted.
93 Tren de Aragua Members Charged by the Justice Department
The ATM jackpotting investigation is part of a broader federal crackdown on Tren de Aragua’s U.S. operations. The Justice Department has charged 93 Tren de Aragua members in connection with various criminal activities, reflecting the scale of law enforcement’s effort to dismantle the organization’s American foothold. These charges span multiple jurisdictions and cover a wide range of offenses from violent crimes to financial fraud.
The Nebraska federal grand jury indictments — which specifically targeted the ATM jackpotting network — brought in dozens of additional defendants beyond the TdA membership charges. This layered prosecution strategy, targeting both the cybercriminal infrastructure and the terrorist organization it served, represents one of the most complex joint law enforcement efforts in recent memory involving both cybercrime and terrorism financing statutes.
Charges Canelon Aguirre Faces
Federal prosecutors have leveled four serious charges against Canelon Aguirre, each carrying significant prison time under U.S. law. The charges reflect both the technical nature of the crime and its connections to organized terrorism financing:
- Conspiracy to Commit Bank Fraud — for orchestrating the unauthorized extraction of cash from federally insured financial institutions
- Conspiracy to Commit Bank Burglary and Intentionally Damage a Protected Computer System — for directing crews to physically access ATM internals and install malware
- Conspiracy to Commit Money Laundering — for routing stolen funds through a complex network designed to conceal their criminal origin
- Conspiracy to Provide Material Support to a Foreign Terrorist Organization — for allegedly channeling stolen funds to Tren de Aragua, a U.S.-designated foreign terrorist organization
That last charge is the most consequential. Providing material support to a designated foreign terrorist organization under 18 U.S.C. § 2339B carries a potential sentence of up to 20 years in federal prison per count. Combined with the bank fraud and money laundering charges, Canelon Aguirre faces the prospect of decades behind bars if apprehended and convicted. The breadth of the charges also signals that federal prosecutors are treating this not as a standalone cybercrime case but as a terrorism-adjacent prosecution.
The $1 Million Reward and How to Report a Tip
The FBI is offering a reward of up to $1 million for information that leads directly to the arrest of Anibal Alexander Canelon Aguirre — one of the largest rewards ever offered for a cybercrime fugitive. Tips can be submitted online at tips.fbi.gov, by calling the FBI’s toll-free tip line at 1-800-CALL-FBI (1-800-225-5324), or by contacting the nearest U.S. Embassy or Consulate if you are located outside the United States. Given his known ties to Venezuela and Mexico, the FBI is particularly interested in any information originating from those regions.
Frequently Asked Questions
Here are answers to the most common questions people are asking about the international ATM jackpotting conspiracy and the fugitive at its center. For insights into the impact of technological advancements, explore the rising environmental costs of data centers.
What Is ATM Jackpotting?
ATM jackpotting is a type of cyberattack where criminals install malware — or specialized hardware — directly onto an ATM’s internal operating system, forcing it to dispense large amounts of cash on command. The name comes from the idea of a slot machine hitting the jackpot, except in this case the “winnings” are stolen directly from the bank.
Unlike traditional ATM fraud involving skimming devices that steal card data, jackpotting attacks target the machine itself. Criminals typically gain physical access to the ATM’s internal components by disguising themselves as maintenance technicians, then load the malicious software that gives them remote or direct control over the cash-dispensing mechanism.
Once the malware is active, the ATM bypasses its normal verification and withdrawal limit controls entirely. In the Canelon Aguirre conspiracy, the FBI confirmed that malware was being deployed against federally insured U.S. banks starting at least as early as January 2024, resulting in hundreds of incidents and more than $20 million in documented losses.
Who Is Anibal Alexander Canelon Aguirre?
Anibal Alexander Canelon Aguirre is a 49-year-old Venezuelan national who the FBI alleges is the primary architect of a large-scale international ATM jackpotting operation. Known by the aliases “Prometheus” and “The Engineer,” he is accused of developing and distributing the malware used by criminal crews deployed across the United States to steal cash from ATMs and funnel the proceeds to Tren de Aragua.
He was added to the FBI’s Ten Most Wanted Fugitives list in March 2026 — making him the first person accused of cybercrimes to ever appear on that list. A federal arrest warrant was issued for him on December 9, 2025, out of a Nebraska federal court. He is believed to be outside the United States, has known ties to Venezuela and Mexico, and is considered armed and dangerous.
What Is Tren de Aragua?
Tren de Aragua, commonly referred to as TdA, is a Venezuelan criminal organization that originated inside the Tocorón Penitentiary in Aragua state, Venezuela. What began as a prison gang eventually evolved into a transnational criminal enterprise with operations spanning multiple South American countries, Central America, and increasingly, the United States.
The gang is involved in a wide range of violent criminal activity including human trafficking, drug smuggling, extortion, and murder. Their expansion into the U.S. has made them a significant law enforcement priority at both the federal and local level, prompting the U.S. government to formally designate them as a foreign terrorist organization — a classification that makes providing them any form of material support a federal crime.
The connection between Tren de Aragua and the ATM jackpotting conspiracy is direct and documented by federal prosecutors. The FBI has described Canelon Aguirre as the mastermind behind the malware TdA used to attack U.S. banks, positioning the financial crimes as a deliberate revenue-generating operation for the gang’s broader terrorist activities. Key facts about Tren de Aragua include:
- Originated in Venezuela’s Tocorón prison before expanding internationally
- Designated as a foreign terrorist organization by the U.S. government
- Involved in human trafficking, drug smuggling, extortion, and violent crime
- The Justice Department has charged 93 TdA members as part of ongoing federal prosecutions
- Connected to the ATM jackpotting conspiracy through money funneled from stolen U.S. bank cash
How Did Canelon Aguirre Carry Out Crimes Remotely From Venezuela?
Canelon Aguirre’s alleged role was entirely on the technical side of the operation. According to the FBI, he developed and distributed the malware that criminal crews — physically present in the United States — installed on ATMs at targeted financial institutions. This remote-architect model allowed him to direct a nationwide criminal operation without crossing into U.S. jurisdiction, a deliberate strategy used by sophisticated international cybercriminals to complicate prosecution efforts, similar to the global crackdown in Interpol Operation Synergia III.
The crews on the ground handled the physical installation of the malware, while Canelon Aguirre reportedly provided the technical infrastructure and remote support that made the cash withdrawals possible. This division of labor — separating the technical mastermind from the street-level operators — is a structure federal investigators have increasingly encountered in transnational cybercrime cases. It’s also precisely why placing him on the Ten Most Wanted list and offering a $1 million reward represents such a critical step: cutting off the technical head of the operation is the most effective way to disable the entire network.
What Should I Do If I Have Information About Canelon Aguirre’s Whereabouts?
If you have any information about the location or activities of Anibal Alexander Canelon Aguirre, the FBI is urging the public to come forward immediately. The bureau is offering a reward of up to $1 million for tips that lead directly to his arrest, making this one of the most lucrative tip rewards currently active in a U.S. federal investigation.
You can submit information through the following official channels, as highlighted in Interpol’s Operation Synergia III.
- Online tip submission at tips.fbi.gov
- Toll-free phone line: 1-800-CALL-FBI (1-800-225-5324)
- Contact your nearest U.S. Embassy or Consulate if you are outside the United States
- Reach out directly to the FBI Omaha Field Office, which is the lead office on this investigation
Given that Canelon Aguirre is considered armed and dangerous, the FBI strongly advises that members of the public do not attempt to apprehend him themselves. If you believe you have spotted him, contact law enforcement immediately and do not approach. For more information on international law enforcement efforts, check out Interpol’s recent operations.
Tips can be submitted anonymously. The FBI has a long track record of protecting the identity of confidential informants, and given the Tren de Aragua connection — a gang with a documented history of violent retaliation — anonymous reporting is strongly recommended for anyone with information originating from Venezuela or Mexico.
Stay current on this developing case and others like it — follow the latest crime news and federal investigations as they unfold.
The recent Interpol operation aimed at dismantling cybercrime networks has led to the arrest of numerous individuals involved in various illicit activities. This global effort, known as Operation Synergia III, successfully shut down thousands of malicious IPs and resulted in significant arrests worldwide. The operation highlights the growing threat of cybercrime and the importance of international cooperation in combating these sophisticated networks.