FBI captures ATM jackpotting kingpin accused of stealing millions of dollars
The suspect tried to turn ATMs into his personal piggy bank, but failed miserably.
ATM jackpotting. Image by Cybernews
Follow us
- The FBI arrested Anibal Alexander Canelon Aguirre at sea over an alleged ATM jackpotting scheme.
- Investigators say Ploutus malware let criminals force ATMs to dispense cash without cards or bank authorization.
- The FBI estimates about $61 million has been stolen from ATMs since 2021.
- Nearly 350 Tren de Aragua members and associates have been charged in the US over the scheme.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
The FBI has arrested a Venezuelan national for his alleged role in an ATM jackpotting scheme.
Anibal Alexander Canelon Aguirre was apprehended at sea by the US Coast Guard. He’s being accused of developing the malware that was used by the Venezuelan gang Tren de Aragua to steal money from ATMs in the district of Nebraska.
The malware that was used to grab cash from ATMs is known as Ploutus and is described as a highly sophisticated, persistent, and evolving suite of malicious code, compatible with multiple ATM platforms and manufacturers.
“Ploutus allows threat actors to force an ATM to dispense cash without using a bank card, customer account, or bank authorization. Once Ploutus is installed on an ATM, it gives threat actors direct control over the machine, allowing them to trigger cash withdrawals,” the FBI’s Internet Crime Complaint Center (IC3) explained in a Flash Alert that was published in February.
Ploutus was designed to attack the ATM itself rather than individual customer accounts, enabling fast cash-out operations that can occur in minutes and are often difficult to detect until after the money is withdrawn.
According to the FBI, Aguirre was able to remotely determine the amount of money in any compromised ATM infected with the Ploutus malware. This knowledge was used to determine which ATMs members of Tren de Aragua would loot.
The FBI estimates that approximately $61 million has been taken from ATMs since 2021, with half of the proceeds being transferred to Tren de Aragua.
Most wanted list
Aguirre was added to the FBI’s Ten Most Wanted list in March 2026. He was wanted for bank fraud, bank burglary, money laundering, damaging protected computer systems, and providing material support to terrorists.
Over the past 18 months, nearly 350 members and associates of Tren de Aragua have been charged in the US for their role in the ATM jackpotting scheme.
In August, 27-year-old Juan Manuel Gouveia-Aguilera was sentenced to 96 months in prison for ATM jackpotting, stealing approximately $3.5 million from ATMs across the US.
In September, 5 Venezuelan nationals pleaded guilty to attempting to steal money from ATMs in the US.
