Violent Gang Hits ATMs—Banks Bleed Millions

Two Venezuelan illegal aliens tied to a violent foreign gang just got over six years in prison for helping steal millions from American ATMs, and their case shows how border failures and cybercrime now work hand in hand against U.S. families.

Story Snapshot

Two Venezuelan illegal aliens admitted using Ploutus malware to force ATMs to spit out cash and were sentenced to 78 months in federal prison.
Prosecutors say the scheme is linked to Tren de Aragua, a violent transnational gang that used stolen U.S. bank money to fuel its operations.^[3]^[11]
The network’s “ATM jackpotting” attacks are part of a larger conspiracy where at least 87 people have been charged in Nebraska alone.^[1]^[3]
Federal agents describe Ploutus malware as designed not only to steal cash, but to delete evidence and hide the crime from banks.^[3]^[1]

Illegal Aliens, Violent Gang, and a Nationwide ATM Cash‑Out Plot

Federal prosecutors say Carlos Javier Padron, 36, and Oddry Arnoldo Cabrera Torrealba, 37, both illegal aliens from Venezuela, played hands‑on roles in a nationwide ATM “jackpotting” conspiracy.^[3]^[10] Court records show they were part of a larger criminal network that developed and deployed a variant of Ploutus malware on bank and credit union ATMs across the United States.^[3]^[1] Once installed, this code let criminals send direct commands to the ATM’s cash dispenser, bypassing normal security checks and causing the machines to dump cash on demand.^[3]^[1]

The Department of Justice says this same network has deep ties to Tren de Aragua, a violent Venezuelan gang that has spread across the Western Hemisphere.^[3]^[1] That gang and its associates allegedly used jackpotting attacks to steal millions of dollars from U.S. financial institutions and then move the money through their network to hide where it came from.^[12]^[8] In Nebraska alone, a federal grand jury has now charged at least 87 defendants in the broader scheme, including material support for a designated foreign terror organization, bank burglary, computer damage, and money laundering.^[1]^[3]^[11]

How Ploutus Malware Turns ATMs into Criminal Cash Machines

According to Justice Department filings, the Ploutus malware used in this conspiracy was built for one main purpose: to send unauthorized commands to the ATM’s cash dispensing module so criminals could force withdrawals of currency.^[1]^[3]^[12] The malware interacts directly with the hardware that controls cash, bypassing the usual software safeguards and card checks that protect customer accounts.^[21]^[19] Investigators say Ploutus in this case was also configured to delete logs and other traces of itself, making it harder for banks and credit unions to even realize their machines had been hacked.^[1]^[3]^[5]

To pull off these heists, crews first had to gain physical access to the machines. Prosecutors describe teams of conspirators and Tren de Aragua members traveling in groups, using multiple vehicles to scout and test targeted ATMs.^[2]^[4] They opened the hood or door of the ATM, checked for alarms or police response, and then installed malware through hard drives or external devices.^[2]^[5] Once the code was active, “cash‑out” operators could stand at the machine and empty it in minutes, sometimes pulling tens of thousands of dollars from a single device before driving off.^[7]^[23] Members then split the proceeds in preset shares across the network.^[1]^[2]

Sentences, Restitution, and the Larger ATM Jackpotting Wave

Padron and Cabrera Torrealba both pleaded guilty to one count of conspiracy to commit bank burglary and one count of computer fraud and intentional damage to a protected computer.^[3]^[10] A federal judge sentenced each of them to 78 months in prison—more than six years—and ordered them to jointly pay $1,537,696 in restitution to several victim banks.^[3]^[10] The Federal Bureau of Investigation (FBI) and Justice Department highlighted the case on social media as part of “Operation Riptide,” a campaign that targets the criminal actors and financial networks behind cyber fraud against Americans.^[1]^[24]

Venezuelan illegal immigrants linked to Tren de Aragua sent to prison for ATM hacking scheme | Washington Examiner

Two illegal immigrants were sentenced to over six years in federal prison for stealing millions of dollars from ATMs in a hacking conspiracy known as “jackpotting.”… pic.twitter.com/5DeUhNdka2

— Owen Gregorian (@OwenGregorian) June 29, 2026

This case is one piece of a broader surge in ATM jackpotting that now demands serious attention from banks and law‑abiding citizens. The Federal Deposit Insurance Corporation Office of Inspector General reports that the FBI estimated about 700 jackpotting incidents and more than $20 million in losses in 2025 alone.^[21]^[24] Many of these attacks use Ploutus or similar malware families, often linked to organized gangs operating across borders.^[19]^[25] Cybersecurity analysts say Ploutus‑based attacks have caused over $450 million in global losses since large‑scale use began in Mexico in 2013.^[23]^[19]

What This Means for Border Security, Banking, and Everyday Americans

The pattern is clear: foreign criminal gangs, including Tren de Aragua, are exploiting weak immigration enforcement and modern cyber tools to reach deep into our financial system.^[3]^[11]^[8] In case after case, investigators identify Venezuelan nationals living illegally in the United States as key players in highly organized jackpotting crews that drain cash from ATMs in multiple states.^[14]^[16]^[17]^[18] For regular Americans, these crimes threaten the stability of local banks and credit unions and raise costs that can show up as higher fees and tighter access to cash.

Law enforcement officials are urging financial institutions to harden both physical and digital defenses. Federal advisories recommend unique locks instead of generic keys, sensors on ATM doors, strict control of USB ports, and “whitelisting” so only approved hardware and software can interact with machines.^[19]^[20]^[21] Banks are also told to watch for unusual activity, like ATM doors open outside maintenance windows or new executable files on hard drives, and to treat suspected jackpotting scenes like serious crime scenes.^[21]^[22] These steps matter because every dollar stolen in these schemes is a dollar taken from the American financial system and, ultimately, from U.S. communities.