Background and Timeline: US federal authorities announced a massive crackdown on an international organized crime syndicate on Monday, January 26, 2026. A federal grand jury in the District of Nebraska returned an additional indictment charging dozens of individuals linked to the notorious Tren de Aragua gang. The case follows a multi-year investigation into a highly coordinated “ATM Jackpotting” campaign that has targeted financial institutions across the United States.

Modus Operandi: The syndicate utilized a “Physical Bypass” technique, where gang members would physically open the outer casing of an ATM at night and connect a laptop to the machine’s internal system. They deployed specialized malware to override the ATM’s security protocols and command the machine to “jackpot”—dispensing all its cash simultaneously without requiring a bank card. The gang also surveilled potential target machines to see if tampering triggered any audible or silent police alarms before committing to a hit.

Victims and Financial Impact: The gang is accused of stealing at least $5.4 million from 63 different ATMs, primarily targeting small credit unions and community banks with less sophisticated security systems. The financial impact includes the direct loss of cash and the multi-million dollar costs for repairing or replacing the tampered machinery. The Tren de Aragua network has caused multi-state disruptions, with coordinated attacks reported across the US Southeast and Midwest throughout 2025.

Investigation and Agencies Involved: The investigation was a joint effort between the U.S. Secret Service and the South Carolina Law Enforcement Division (SLED), utilizing technical diagnostics from the targeted ATMs. Prosecutors from the US Department of Justice are handling the case, which now includes 87 total charged defendants representing one of the largest ATM hacking probes in history. Authorities utilized “ATM surveillance forensics” to link the physical movements of the gang members across state lines.

Arrests and Suspects: A total of 87 individuals, mostly Venezuelan nationals, have been charged in the conspiracy to deploy malware and steal millions of dollars. Two specific suspects were recently convicted in South Carolina for their roles in physically connecting the malware to ATMs at night. Authorities are now focusing on identifying the higher-level technical developers who created the custom “jackpotting” software and sold it to the Tren de Aragua affiliates as a service.

Broader Implications and Trends: This case exposes the role of “Transnational Criminal Organizations” in weaponizing high-tech tools for localized physical crimes. It demonstrates a growing trend where malware is delivered not through the cloud, but through physical “edge” devices like ATMs and point-of-sale terminals. Experts have warned that as banks enhance their digital security, gangs are reverting to these “hybrid attacks” that combine hardware tampering with software exploitation.