A Venezuelan man, Anibal Alexander Canelon Aguirre, 50, also known as “Prometheus” and “The Engineer,” stands accused of being a key figure in a multimillion-dollar ATM hacking scheme. The U.S. Justice Department has announced his apprehension and extradition to face federal charges. The operation is allegedly linked to the Tren de Aragua gang, a significant Venezuelan crime syndicate.
Canelon Aguirre appeared before U.S. Magistrate Judge Michael D. Nelson in Nebraska, pleading not guilty to four counts. Currently, he remains detained in Nebraska as he awaits trial. Efforts to reach his legal team and the FBI for comment were made outside office hours.
Tren de Aragua, initially a Venezuelan prison gang, expanded throughout the Western Hemisphere. This organization has been associated with various criminal activities, including drug trafficking, firearms offenses, kidnapping, and extortion. In February 2025, the Trump administration designated Tren de Aragua as a foreign terrorist organization.
The FBI placed Canelon Aguirre on its Most Wanted Fugitives list in March 2026. He is the first alleged cybercriminal to receive this designation, becoming the 540th person on the list. While the Justice Department did not specify Canelon Aguirre’s place of apprehension, his indictment by a federal grand jury came in December 2025.
Charges against him include conspiracy to commit bank fraud and burglary, fraud involving computers, money laundering, and providing material support to terrorists. The FBI alleges that Canelon Aguirre orchestrated an extensive international plot to steal funds from U.S. financial institutions to benefit Tren de Aragua. This scheme reportedly began in January 2024.
Canelon Aguirre is said to have developed the Ploutus malware used in “ATM jackpotting.” In such attacks, malware forces ATMs to dispense cash without deducting it from bank accounts. Prosecutors claim the malware was designed to avoid forensic analysis and included functionalities to erase itself, concealing its use from financial institutions.
Assistant Attorney General A. Tysen Duva stated that Canelon Aguirre was a central figure in creating this malware, aiding Tren de Aragua’s criminal ventures across the U.S. and beyond. The bank fraud conspiracy charge holds a potential 30-year sentence and a $1 million fine, while conspiracy to launder money could lead to a 20-year sentence. The charge for conspiracy to provide material support to terrorists carries a possible 15-year sentence.
These charges are allegations, and Canelon Aguirre is presumed innocent until proven guilty in court. The investigation has revealed that ATM jackpotting attacks occurred in 47 states, Washington, D.C., and several other countries. The District of Nebraska has charged 120 defendants in relation to this conspiracy.
Already, three defendants have been sentenced: Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padron received 78 months, and Juan Manuel Gouveia Aguilera got 96 months. FBI Director Kash Patel noted Canelon Aguirre’s capture as the 10th apprehension on the Ten Most Wanted list since the Trump administration’s start.
The FBI’s management of the Ten Most Wanted list faced scrutiny. An investigation by MS NOW pointed out instances of fugitives being added near arrest time, potentially inflating perceived success. However, the FBI rejected claims of miscounted arrest figures.