OFAC added 11 Tren de Aragua entries on 30 September. The FBI has had the alleged ringleader on its Ten Most Wanted list since February

The US Treasury added 11 entries to the SDN List on 30 September over Tren de Aragua, or TdA, the Venezuelan gang the State Department designated a foreign terrorist organization in February 2025. Treasury's headline is about money stolen from US banks. The method was malware.

Treasury's press release counts "10 targets" in the ATM scheme: eight people and the two companies. The eleventh entry is Juan Gabriel Rivas Nunez, known as Juancho, who Treasury says is reportedly a high-ranking TdA leader directing gold mining, narcotics exports and violent crime from several South American countries. He was indicted in the Southern District of Texas in December 2025, and Treasury does not connect him to the cash machines. The list holds nine people, not ten.

The same action removed three parties: Patraca, S.A. de C.V., also listed as Boutique Patraca, under the narcotics programme; the cargo ship MARAYA, formerly MED PATRON, IMO 7514517, under Libya; and Tatyana Protopovich under Belarus. Each appears on the deletion list twice, once per name, so a local copy of the list has to drop both names to stop returning them.

Treasury calls it jackpotting. A crew surveys a cash machine, breaks into it and installs malware. Someone then triggers the malware remotely and the machine pays out until it is empty or someone stops it. No account is debited.

Treasury puts reported losses from alleged jackpotting attacks in the United States at $40.73 million across more than 1,500 attacks as of August 2025. That figure covers alleged attacks generally, not this network alone. The release says the Justice Department has indicted 98 people for jackpotting since 21 October 2025. Treasury says the cash is passed between members and laundered, "among other methods", through cryptocurrency.

The man Treasury says runs it is Anibal Alexander Canelon Aguirre, "Prometheus", whom it calls "the alleged engineer of the malware". Six of the other seven people in the ATM network are his associates, indicted in the US District Court for the District of Nebraska. The seventh, Aslhy Javier Galeano Basurto, was indicted there too and, Treasury says, was detained in the United States in 2017 on suspicion of manipulating cash machines.

Canelon Aguirre was not a secret before 30 September. The FBI's wanted-persons feed shows his Ten Most Wanted poster published on 17 February 2026, after a federal arrest warrant issued in Nebraska on 9 December 2025. The FBI offers up to $1,000,000 for information leading to his arrest.

The two records agree on the facts that matter for screening and disagree on the names:

The FBI has three name variants that OFAC does not. One drops his first surname, one drops his second and one hyphenates them. A business that screened only sanctions lists had no SDN entry to match him against until 30 September. A business that also screened the FBI's feed had him in February, with a date of birth to confirm the hit.

Seven of the nine individual entries carry one Tron address each, printed as Digital Currency Address - TRX followed by the address. Canelon Aguirre's, for example, is TJjRAn9kLiyh8h6gjBjaYjkfDkskgZfyW9. The two people without one are Galeano Basurto and Rivas Nunez.

An address is the most precise identifier on the list. It is either the same 34 characters or it is not, so there is nothing to tune and no false positive to clear. A payment to one of these wallets from an exchange account opened under another name passes a name screen cleanly. If you move crypto, screen the address field on every transfer against the SDN List's digital currency addresses, not just the names on the account.

The list now holds GALEANO BASURTO, Aslhy Javier and GALEANO BAZURTO, Jose Dario. They are two people, born on 9 May 1984 and 26 March 1993, with different Venezuelan cedula numbers. The surnames differ by a single letter, S for Z. Any fuzzy matcher worth using will return both for a query on either. Treasury's release does not say whether they are related, so neither do we.

The alert can only be closed on the date of birth and the cedula. A file that records "Galeano — SDN match" cannot later show which of the two it meant.

Rivas Nunez is harder in a different way. His entry carries two aliases under an entirely different name, APONTE RODRIGUEZ, Wilson Stalyn and APONTE RODRIGUEZ, Wilson Starling, plus a Latin-script spelling RIVAS NUÑEZ with the tilde. A system that screens primary names only will not connect a customer called Wilson Aponte to the entry at all.

Treasury adds one detail about MARTINEZ ARMENTA, Carlos Javier: he "has transacted directly with" Hector Rusthenford Guerrero Flores, known as Nino Guerrero, whom the release calls the now-deceased head of TdA.

The two companies are owned by men in the network, and their names give no hint of it:

"Soluciones integrales", integrated solutions, is a generic phrase, so expect the second entry to raise alerts on unrelated suppliers. Each entry carries a Folio Mercantil number from the Mexican commercial register, N-2024061521 and N-2016012368. That number, not the name, is what separates the designated company from an innocent one with a similar name.

Under OFAC's 50 percent rule, companies owned 50 percent or more by any of the 11 are blocked too, whether or not they appear on the list. Treasury's release names only these two.

Every one of the 11 entries carries the line "Secondary sanctions risk: section 1(b) of Executive Order 13224". Treasury's release spells out what that means. OFAC can cut off or restrict the US correspondent or payable-through account of a foreign financial institution that knowingly conducts or facilitates a significant transaction for one of these people. That reaches a European bank or payment institution that holds a US correspondent account, whether or not any particular payment clears in New York.

Treasury puts the network in Mexico and Venezuela. The entries add a third country: Hernandez Guerrero is a Colombian national with a Mexican address and a Mexican CURP. Martinez Pirona's entry gives both Venezuela and Mexico.

1. Re-screen customers and beneficiaries with links to Venezuela, Mexico or Colombia against the updated SDN List, including the alias field. Rivas Nunez's entry matches a customer called Wilson Aponte only through the alias field.
2. Add the seven Tron addresses to address screening if you process crypto, and look back through past transfers for them.
3. Resolve Galeano hits on date of birth and cedula. Record which of the two entries a match was against.
4. Check Mexican suppliers and merchants by Folio Mercantil number, not by name, when they resemble the two companies.
5. Screen wanted-persons lists as well as sanctions lists. The FBI had Canelon Aguirre's name and date of birth in February.

All 11 names were in our production data the same day in Washington. They arrived with the automatic list refresh at 00:00 UTC on 1 October, still the evening of 30 September there, and the three removed parties dropped out in the same refresh. Nobody imported anything; the lists are monitored and refreshed on a schedule. Canelon Aguirre's FBI record, with all five aliases and his date of birth, was already in our criminal-watchlist data when we checked. A Quick Check screens the FBI's wanted feed by default, as part of a criminal-watchlist domain reported separately from sanctions, because a wanted poster and a designation call for different next steps.

This is a report of what OFAC and Treasury published on 30 September 2026 and what the FBI's public wanted record for Canelon Aguirre showed on 1 October. It takes no position on the guilt of anyone named. An indictment is an allegation.

These are US measures. We have not checked EU or UK lists for the 11 names, and absence from a name search is not absence from a list.