Millions Stolen, ATMs Hijacked: Foreign Crime Ring Sentenced

United States courthouse with American flag waving.

America’s cash machines are being turned into criminal slot machines by foreign gangs exploiting weak borders and weak systems.

Story Snapshot

Two Venezuelan illegal immigrants received 78‑month prison sentences for a nationwide ATM “jackpotting” cyber theft tied to the Tren de Aragua gang.
The men used Ploutus malware to force ATMs to spit out cash and delete evidence, stealing millions from banks across the United States.^[3]
Federal prosecutors say Tren de Aragua used this money to fund violent crimes, including rape and child sex trafficking, in the United States.^[5]
The case exposes how organized foreign crime, cyber weaknesses, and immigration failures combine to drain banks and erode public trust in government.

How the ATM Jackpotting Plot Worked

Federal prosecutors say Carlos Javier Padron and Oddry Arnoldo Cabrera Torrealba were part of a sophisticated criminal network that targeted ATMs across the United States.^[3] Court records explain that the group relied on a malware family called Ploutus, which was installed directly onto ATM systems after gaining physical access.^[3] Once activated, the malware let co‑conspirators talk straight to the machine’s cash dispenser module, bypassing normal bank checks and card use.^[3] That turned each compromised ATM into a controllable cash hose.

According to the Department of Justice, the Ploutus malware did more than just release cash.^[3] It was designed to delete traces of itself, hiding evidence from bank staff and making it harder for investigators to see what happened.^[3]^[4] This meant the machines could be hit, drained, closed, and then sometimes hit again before patterns were clear. Cyber experts describe this kind of “jackpotting” as a mix of physical break‑ins and digital control, using ports, hard drives, or hidden devices to override normal security.^[19]^[23] It is a crime built on both code and weak hardware protection.

Sentences, Restitution, and Ties to Tren de Aragua

A federal judge sentenced both Padron and Cabrera Torrealba to 78 months in prison for conspiracy to commit bank burglary and computer fraud involving protected computers.^[3] The court also ordered them to repay $1,537,696 in restitution to multiple victim banks.^[3] A Justice Department press release identifies them as illegal immigrants from Venezuela who helped deploy sophisticated malware as part of a transnational criminal network.^[3] Officials say the broader scheme stole millions of dollars through ATM jackpotting, hitting banks and credit unions nationwide.^[4]

The same Justice Department investigation links this network to Tren de Aragua, a violent Venezuelan criminal organization that now operates across the Western Hemisphere, including inside the United States.^[1]^[4]^[6] In a related Nebraska case, prosecutors report that 87 defendants tied to the group have been charged in the wider jackpotting conspiracy.^[6] The indictment states that Ploutus malware was used to issue unauthorized commands to ATM cash dispensers and that members of Tren de Aragua split the proceeds after each hit.^[6] Federal officials further say stolen money was used to fund gang activities including rape, murder, and child sex trafficking in Nebraska.^[5]

A Growing Cybercrime Pattern and a Strained System

This case is not a one‑off event but part of a larger surge in ATM jackpotting across the U.S. banking system.^[21] The Office of Inspector General for the Federal Deposit Insurance Corporation reports that criminal rings now regularly access ATMs, swap or infect hard drives, and install malware that talks directly to the hardware, bypassing normal software controls.^[21] The Federal Bureau of Investigation estimates around 700 jackpotting incidents and over $20 million in losses in 2025 alone.^[21]^[24] That figure reflects only known cases; actual losses may be higher.

Cybersecurity researchers say Ploutus has been one of the most damaging tools in this wave of attacks since it first appeared in large‑scale use in Mexico in 2013, causing hundreds of millions of dollars in global losses.^[23] They explain that the malware targets the Extensions for Financial Services software layer, which converts digital instructions into physical actions like dispensing cash.^[19] By hijacking that layer, attackers can make an ATM pay out without touching any customer account. Banks are urged to upgrade physical locks, add sensors, whitelist devices and software, and configure machines to shut down when jackpotting warning signs appear.^[19]^[20]^[21]

Why This Hits Nerves on Both the Right and the Left

For many readers, this story blends several deep frustrations: border security failures, rising organized crime, and a financial system that seems easier for gangs to loot than for ordinary families to navigate. Conservatives see yet another example of illegal immigrants tied to a foreign gang using advanced tools to steal from U.S. banks, while taxpayers and customers are left holding the bag.^[1]^[3]^[6] Liberals look at the same facts and worry about widening inequality, global criminal networks, and a justice system that often reacts late instead of preventing harm.

Across the political spectrum, people ask how a transnational gang like Tren de Aragua could spread across the Americas while federal agencies, with huge budgets and surveillance powers, struggled to stop it early.^[4]^[6]^[7]^[8] They see cyber warnings, technical memos, and flashy press releases after indictments, but not a clear sense that government systems are ahead of the threat.^[20]^[21] When cash meant for local businesses and families is drained by foreign crews using malware, it reinforces a common belief: the “elites” running major institutions talk about security and justice, but ordinary citizens absorb the risks and costs.