The U.S. Treasury Department's Office of Foreign Assets Control designated eight individuals and two Mexico-based companies over an alleged Tren de Aragua ATM jackpotting network, identifying seven Tron addresses linked to Anibal Alexander Canelon Aguirre, known as Prometheus, and six alleged associates. Treasury said the network used malware to make U.S. ATMs and interactive teller machines dispense cash, then allegedly laundered proceeds through cryptocurrency and other channels. TRM Labs said the seven exchange-hosted Tron deposit addresses received about $6.1 million since March 2022, while cautioning that not all inflows were necessarily linked to jackpotting. The largest address, attributed to Eric Gabriel Cardenas Arzola, received about $2.1 million, including the most recent identified inflow in July 2026. The designated addresses transferred funds to other TdA-linked wallets that subsequently moved about $35 million to a network U.S. authorities associate with Jorge Figueira, who faces unresolved allegations of laundering about $1 billion. Treasury reported $40.73 million in U.S. losses from more than 1,500 alleged attacks as of August 2025. Because the addresses are hosted by a centralized exchange, TRM said the provider may be able to identify the account holders and related activity; institutions processing significant transactions for designated parties also face potential secondary-sanctions exposure under Executive Order 13224.