FBI Top 10 Cybercriminal Aguirre Faces U.S. ATM Jackpotting Charges

Anibal Alexander Canelon Aguirre, the first cybercriminal ever placed on the FBI’s Top 10 Most Wanted Fugitives list, pleaded not guilty in a Nebraska district court on Friday. The 50-year-old Venezuelan national, also known as 'Prometheus' and 'The Engineer,' is now in U.S. detention after being apprehended abroad, though officials declined to confirm an extradition. FBI Director Kash Patel stated Aguirre is now "back in the United States to face justice." A Justice Department spokesperson confirmed Aguirre was not in the United States but was not extradited, declining to explain the legal mechanism of his return.

The Ploutus malware and Aguirre’s role

Federal prosecutors allege Aguirre was the mastermind behind the sophisticated Ploutus malware. This powerful tool is used by criminals to forcibly empty ATMs of all their cash. Experts have tracked various versions of Ploutus targeting ATMs across Latin America and the U.S. since 2013. The malware contained anti-analysis measures to hinder forensic review, including software protection utilities to prevent reverse-engineering. It also had files designed to delete itself from a system to conceal deployment. While the FBI claims Aguirre was its architect, some cybersecurity experts have not been able to independently verify he is the true developer.

The Tren de Aragua connection and financial impact

Authorities assert Aguirre's scheme fueled the violent Tren de Aragua (TdA) gang. Assistant Attorney General A. Tysen Duva said the technology helped fuel the criminal operations of this transnational organization. The Justice Department claims extensive links between the Ploutus malware and TdA. The group conducted 117 ATM jackpotting attacks on banks and credit unions between February 2024 and December 2025, typically in remote locations.

The financial impact was severe. Losses often surpassed $100,000 per incident. The total stolen from these attacks exceeded $5.4 million. Proceeds were laundered through cryptocurrency or companies in Mexico before being transferred to TdA accounts. Last week, the U.S. Treasury Department sanctioned Aguirre and several others for laundering the scheme's proceeds. TdA itself was designated a transnational criminal organization in July 2024 and a foreign terrorist organization in February 2025. Since October 2025, the Justice Department has charged 98 suspects in related schemes.

Legal proceedings and potential sentencing

Aguirre was indicted by a federal grand jury in Nebraska last December. He faces multiple charges including conspiracy to commit bank fraud, money laundering, and providing material support to terrorists. If convicted on all counts, he faces a maximum sentence of 70 years in prison. The specific maximum sentences for his charges are as follows:

Aguirre will remain in detention pending his trial. The broader investigation has led to convictions for dozens of people involved in the ATM jackpotting scheme, which U.S. officials have linked to at least 1,500 total attacks causing $40.7 million in losses.