Tron Sanctions Put $6.1 Million in Deposit Addresses Under Review

Seven Tron addresses linked by the US Treasury to the Tren de Aragua network have received about $6.1 million since March 2022, according to TRM Labs. The addresses are deposit addresses hosted at a centralized exchange, which puts exchanges and financial institutions in a position to screen both direct and indirect exposure.

The designation does not prove that every dollar sent to the addresses came from ATM attacks. TRM cautioned that not all of the $6.1 million is necessarily tied to the alleged jackpotting scheme. That distinction matters because an on-chain inflow can show where funds moved, but not always what crime produced them.

What OFAC Designated

The Office of Foreign Assets Control acted on September 30, 2026. It designated eight individuals and two Mexico-based companies connected to an alleged Tren de Aragua ATM jackpotting scheme, a leader involved in illicit gold mining and seven Tron addresses on its SDN List.

The primary target named in the action is Anibal Alexander Canelon Aguirre, also known as Prometheus. TRM Labs says he appears on the FBI’s Ten Most Wanted Fugitives list and is the alleged engineer of the malware used in the attacks. Six additional individuals were designated and linked to the Tron addresses.

The Tron address attributed to Canelon Aguirre is TJjRAn9kLiyh8h6gjBjaYjkfDkskgZfyW9. TRM Labs labeled all seven addresses as sanctioned, with each attributed to one designated individual.

Where The Funds Moved

The address attributed to Eric Gabriel Cardenas Arzola accounts for the largest share of the identified inflows, at about $2.1 million. Most of the seven addresses have been dormant for months. The most recent inflow, to the Cardenas Arzola address, occurred in July 2026.

The designated addresses sent funds to other Tren de Aragua-associated addresses. Those addresses then sent about $35 million to a network that US authorities have linked to Jorge Figueira, a Venezuelan national charged with laundering about $1 billion in illicit funds. Figueira has not been convicted, and the charges against him are allegations.

Because money moved beyond the seven listed addresses, TRM Labs says counterparties one or two hops away may also face sanctions risk. The practical compliance problem is therefore bigger than checking seven strings against a blocklist. It involves following how funds moved onward and identifying any exposure to the associated network.

Why Tron Matters Here

The Tron addresses follow an exchange-hosted deposit pattern that TRM Labs also observed in the September 2026 designation of the Xinbi Guarantee marketplace, where illicit value largely settled in USDT on Tron.

That pattern makes Tron’s role in the case important, but it doesn’t amount to evidence that Tron itself caused the activity or that the network’s broader liquidity changed after the sanctions. The research provides no confirmed TRX price, USDT trading volume or wider Tron market reaction following the designation.

Still, the use of stablecoins and shared infrastructure is a recurring feature of the networks described in the case. Chainalysis found that the counterparties of the wallets had exposure to laundering networks used by Colombian and Mexican cartels and Venezuelan launderers. It said these networks rely heavily on stablecoins. Tether had also previously frozen USDT balances on several wallets exposed to the newly sanctioned addresses.

The useful takeaway is narrower than saying Tron is being targeted. The action gives exchanges and other regulated institutions a specific set of addresses to screen, while the downstream flows show why one-hop and two-hop checks may matter. The seven addresses have received about $6.1 million, but the wider network linked to them has moved far more.