Anibal Alexander Canelon Aguirre, 50, an alleged Tren de Aragua leader and the FBI’s first cyber fugitive on its Ten Most Wanted list, was captured in Venezuela and returned to U.S. custody. He pleaded not guilty in Nebraska to four conspiracy counts related to a multimillion-dollar ATM "jackpotting" scheme and remains detained awaiting trial. Prosecutors allege he helped develop malware used to steal funds and tied the scheme to financing for Tren de Aragua; DOJ officials say nearly 350 alleged members and associates have been charged since the group's designation.
FBI’s First Ever Cyber Fugitive on Ten Most Wanted Captured in Venezuela and Returned to U.S.
FBI's first cyber fugitive on Ten Most Wanted list returns to US after capture in Venezuela
Anibal Alexander Canelon Aguirre, 50, an alleged leader of the Venezuelan group Tren de Aragua and the FBI’s first-ever cyber fugitive placed on its Ten Most Wanted list, has been captured in Venezuela and returned to U.S. custody, authorities say.
Aguirre, who is known by the aliases "Prometheus" and "The Engineer," made an initial appearance Friday in federal court in Nebraska. He pleaded not guilty to four federal conspiracy counts connected to a multi-million-dollar ATM "jackpotting" scheme and will remain detained pending trial, according to the Department of Justice (DOJ).
Charges and Allegations
The four conspiracy counts include bank fraud; bank burglary and computer fraud; money laundering; and providing material support to a designated foreign terrorist organization. Prosecutors say the bank fraud conspiracy count carries the highest potential penalty — up to 30 years in prison.
The DOJ and the FBI allege Aguirre helped develop malicious software and led "a large international conspiracy to steal millions of dollars from financial institutions in support of the Tren de Aragua, through an ATM jackpotting scheme since at least 2024." Authorities say he was apprehended in Venezuela last month before being brought to the United States.
What Is ATM "Jackpotting"?
An ATM "jackpotting" attack is a form of cybercrime in which criminals exploit vulnerabilities in ATM hardware or software — often deploying malware — to force machines to dispense cash. Investigators say the stolen funds were linked to financing activities for Tren de Aragua, which U.S. officials have designated as a foreign terrorist organization.
"Now he's back in the United States to face justice," said Kash Patel, who commented on the arrest. "This FBI is running on supercharged horsepower — and there is nowhere on this planet criminals can hide."
The DOJ said the arrest marks another success for combined federal task forces working on narcoterrorist finance and transnational criminal networks. U.S. officials further stated that nearly 350 alleged Tren de Aragua members and associates have been charged since the group's designation as a foreign terrorist organization.
Next Steps
Aguirre remains detained in Nebraska as the case proceeds. Federal prosecutors will continue their investigation and prepare for trial, while authorities pursue related allegations tied to the broader ATM jackpotting conspiracy.
Reporting note: Fox News Digital contributor Robert McGreevy contributed to reporting on this case.
Help us improve.
