Venezuelan Man Accused of ATM Hacking in U.S. Custody

A Venezuelan man, Anibal Alexander Canelon Aguirre, known by the aliases “Prometheus” and “The Engineer,” has been apprehended and brought to the United States. He faces federal charges for his alleged role in a multimillion-dollar ATM hacking scheme reportedly linked to the Tren de Aragua gang, the Justice Department announced.

Canelon Aguirre, 50, is accused by federal prosecutors of being a leading figure in an international conspiracy. The group allegedly used malicious software to force ATMs to dispense cash, generating funds for Tren de Aragua, a Venezuelan crime syndicate.

On Friday, October 2, Canelon Aguirre appeared before U.S. Magistrate Judge Michael D. Nelson in Nebraska. He pled not guilty to all four counts against him. The Justice Department confirmed he will remain detained in Nebraska while awaiting trial.

The Tren de Aragua gang originated as a prison organization in Venezuela. It has expanded across the Western Hemisphere, becoming involved in various crimes such as drug and firearms trafficking, kidnapping, fraud, extortion, and violent offenses. In February 2025, the Trump administration classified Tren de Aragua as a foreign terrorist organization.

Canelon Aguirre joined the FBI’s Most Wanted Fugitives list in March 2026. He became the first alleged cybercriminal to receive this designation, marking the 540th addition to the list.

The FBI has not disclosed where Canelon Aguirre was apprehended.

Indicted by a federal grand jury in Nebraska in December 2025, Canelon Aguirre faces charges including conspiracy to commit bank fraud, conspiracy to commit bank burglary and fraud in connection with computers, conspiracy to commit money laundering, and conspiracy to provide material support to terrorists.

Authorities claim he led a vast international operation that deployed teams to the United States to steal millions from financial institutions, supporting Tren de Aragua. The scheme allegedly began in January 2024. Prosecutors assert that Canelon Aguirre developed the Ploutus malware, facilitating “ATM jackpotting”—an attack method where criminals install malware to make ATMs dispense money without charging a bank account.

The malware supposedly included protections against forensic analysis and measures to delete itself to avoid detection by financial institutions.

According to Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division, “Anibal Canelon Aguirre served as a key architect of sophisticated malware used to drain ATMs of cash across the United States—technology that helped fuel the criminal operations of the violent transnational organization Tren de Aragua.”

The bank fraud conspiracy charge carries a potential maximum sentence of 30 years in prison and a $1 million fine. The money laundering conspiracy may result in up to 20 years, and the material-support conspiracy could lead to a maximum 15-year sentence.

An indictment is an allegation, and Canelon Aguirre remains presumed innocent unless proven guilty beyond a reasonable doubt.

Investigators highlight that the conspiracy targeted or executed ATM jackpotting attacks in 47 states, Washington, D.C., and several foreign countries. The Justice Department reported that 120 defendants have been charged in connection with this case in the District of Nebraska.

Three individuals have already been sentenced in Nebraska as part of the broader investigation: Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padron received 78 months in prison, while Juan Manuel Gouveia Aguilera was sentenced to 96 months.

FBI Director Kash Patel noted Canelon Aguirre as the 10th person on the FBI’s Ten Most Wanted Fugitives list apprehended since the beginning of the Trump administration.

The FBI’s management of the Ten Most Wanted list has been scrutinized. An MS NOW investigation noted that under Director Patel, several fugitives were added to the list shortly before their arrests, including two within 24 hours of addition. Some additions were made when authorities were nearing the suspects, potentially inflating success appearances. The FBI contested these claims, arguing that allegations of manipulated arrest figures were false.