Terror Gang Steals $40M from ATMs

A person in a black hoodie and gloves tampering with an ATM — $40M ATM HEIST

Venezuelan terrorist gang Tren de Aragua (TdA) siphoned over $40 million from American ATMs to fund violence, but DOJ’s latest indictments deliver a powerful strike against their U.S. operations.

Story Snapshot

DOJ indicts 31 more defendants, mostly Venezuelan and Colombian TdA affiliates, bringing the total charged to 87 in the nationwide ATM jackpotting scheme.
Criminals used Ploutus malware to force ATMs to dispense cash without cards, stealing millions that funded TdA terrorism.
Multi-agency task force disrupts terrorist financing, targeting gang from foot soldiers to leaders across multiple states.
Financial institutions warned to bolster ATM security amid rising foreign cyber-physical threats.

Terrorist Gang’s ATM Heist Method

Tren de Aragua members conducted surveillance on ATMs at banks and credit unions across U.S. states. Attackers tested alarms by tampering with machines during reconnaissance. They then physically accessed ATMs, swapping hard drives or inserting thumb drives loaded with Ploutus malware.

This sophisticated software overrode systems, forcing machines to dispense cash even when no cards or customers were present. The methodical process enabled theft of over $40 million, laundered to support TdA’s terrorist activities. This hybrid cyber-physical attack underscores vulnerabilities exploited by foreign gangs.

Investigation into International “ATM Jackpotting” Scheme and Tren de Aragua results in Additional Indictment and 87 Total Charged Defendants

“Tren de Aragua is a complex terrorist organization that commits serious financial crimes in addition to horrific rapes, murders, and… pic.twitter.com/g15mbJ4pFw

— U.S. Department of Justice (@TheJusticeDept) January 26, 2026

Indictment Timeline and Charges

A Nebraska grand jury issued the first indictment, charging 22 defendants with conspiracy, bank fraud, burglary, computer fraud, money laundering, and material support to terrorists. Before January 2026, Homeland Security Task Force operations added 56 more charges, bringing the total to 56.

This week, the DOJ announced 31 additional indictments in a 32-count superseding document, bringing the total to 87. Maximum sentences if convicted range from 20 to 335 years. Some defendants already arrested as the investigation continues.

Joint Task Force Vulcan, originally formed in 2016 against MS-13, coordinated the nationwide takedown. This effort dismantled TdA’s presence in Nebraska and exposed the network from low-level deployers to malware masterminds.

Proceeds were directly funded to TdA leaders like “Niño Guerrero,” who escaped a Venezuelan prison in 2012 and expanded operations.

Key Players in Prosecution and Crime

U.S. Attorney Lesley A. Woods for Nebraska led announcements, stating millions flowed to Tren de Aragua leaders. FBI Omaha Special Agent in Charge Eugene Kowel highlighted TdA’s direct threat, syphoning funds for terrorism through sophisticated malware. DOJ Acting Assistant AG Matthew R. Galeotti oversaw charges, declaring intolerance for networks aiding terrorists.

Indicted associate Jimena Romina Araya Navarro, photographed with TdA leaders, faces material support charges. Financial institutions suffered losses, prompting the DOJ to issue security warnings.

TdA originated in Venezuela’s Tocorón prison around 2012, growing into a U.S.-designated foreign terrorist organization. Recruiters pulled members for ATM deployments, reflecting a strict hierarchy where leaders directed operations.

Impacts on Security and Economy

Short-term, the indictments disrupt TdA’s U.S. financial pipeline, recover some stolen funds, and alert banks to enhance physical and cyber defenses. Long-term, they weaken terrorist financing and set precedents for prosecuting such hybrid crimes. Communities gain safety from reduced TdA violence, though the Venezuelan diaspora faces added scrutiny.

Economically, $40 million losses compound rising ATM fraud trends, including $333 million in prior bitcoin scams. The banking sector must upgrade against foreign malware threats, bolstering national security under President Trump’s enforcement priorities.