U.S. authorities have detained Anibal Alexander Canelon Aguirre, 50, known as "Prometheus," and flown him to the United States to face federal charges tied to an alleged multimillion-dollar ATM jackpotting scheme. He pleaded not guilty in Nebraska on October 2 and remains detained pending trial. Prosecutors claim he developed Ploutus malware used in attacks across 47 states, Washington, D.C., and abroad, and that roughly 120 defendants have been charged in the broader investigation. He faces charges that carry potential prison terms of up to 30 years for bank fraud plus additional penalties for money laundering and providing material support to terrorists.
FBI Captures 'Prometheus': Alleged Architect of Multimillion-Dollar ATM Jackpotting Scheme Linked to Tren de Aragua
The logo of the Federal Bureau of Investigation (FBI) is seen at the Los Angeles Federal Building after a news conference to provide an update on the investigation into a May 18, 2025, bombing at a fertility clinic in Palm Springs, California, on June 4, 2025, in Los Angeles.
U.S. authorities have arrested a Venezuelan national accused of orchestrating a multimillion-dollar ATM "jackpotting" operation prosecutors say funded the Tren de Aragua transnational criminal organization. Fifty-year-old Anibal Alexander Canelon Aguirre, known to investigators as "Prometheus" and "The Engineer," was brought to the United States to face federal charges, the Justice Department announced.
Arrest, Court Appearance and Charges
Canelon Aguirre appeared before U.S. Magistrate Judge Michael D. Nelson in Nebraska on October 2 and pleaded not guilty to all counts in a federal indictment. He remains detained in Nebraska pending trial. The Justice Department did not disclose where he was apprehended.
A federal grand jury returned the indictment in December 2025. He faces four counts, including conspiracy to commit bank fraud; conspiracy to commit bank burglary and fraud in connection with computers; conspiracy to commit money laundering; and conspiracy to provide material support to terrorists. Statutory maximum penalties include up to 30 years for the bank-fraud conspiracy, up to 20 years for the money-laundering conspiracy, and up to 15 years for the material-support count.
Alleged Scheme and Malware
Prosecutors allege Canelon Aguirre played a principal leadership role in an international conspiracy that used variants of Ploutus malware to force ATMs to dispense cash without debiting customer accounts — a tactic known as "ATM jackpotting." The indictment says the code included anti-forensic features intended to frustrate analysis and components capable of removing the malware from infected systems to conceal attacks from banks and investigators.
"Anibal Canelon Aguirre served as a key architect of sophisticated malware used to drain ATMs of cash across the United States — technology that helped fuel the criminal operations of the violent transnational organization Tren de Aragua," said Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division.
Scope Of The Investigation
The Justice Department says the wider conspiracy operated since at least January 2024 and that investigators have linked related ATM jackpotting incidents to 47 U.S. states, Washington, D.C., and several foreign countries. In all, prosecutors have charged roughly 120 defendants in the U.S. District Court for the District of Nebraska in connection with the alleged scheme.
Anibal Alexander Canelon Aguirre, known as "Prometheus" and "The Engineer," is accused of helping lead a multimillion-dollar ATM hacking operation linked to Tren de Aragua.
Three defendants already sentenced in the Nebraska prosecutions include Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padron (each sentenced to 78 months) and Juan Manuel Gouveia Aguilera (96 months).
FBI Most Wanted Designation And Oversight
Canelon Aguirre was added to the FBI's Most Wanted Fugitives list in March 2026, becoming the 540th person named to the list and the first individual described by the agency as an alleged cybercriminal to receive that designation. FBI Director Kash Patel noted that Canelon Aguirre was the 10th person on the Ten Most Wanted list captured since the start of the current administration.
The FBI's handling of the Ten Most Wanted list has faced scrutiny after reporting that some fugitives were added shortly before arrests, a practice critics say can create a misleading impression of proactive success. The agency has disputed those accusations.
Background: Tren de Aragua began as a Venezuelan prison gang before expanding across the Western Hemisphere and has been linked by U.S. officials to drug and firearms trafficking, kidnapping, extortion, fraud and violent crime. The organization was designated a foreign terrorist organization by the U.S. in February 2025.
Presumption of Innocence: An indictment is an allegation. Canelon Aguirre is presumed innocent unless proven guilty beyond a reasonable doubt.
Help us improve.
