The first hacker ever placed on the FBI’s Ten Most Wanted list is back on American soil and has stood before a federal judge in Nebraska. Prosecutors say Anibal Alexander Canelon Aguirre, a 50-year-old Venezuelan, wrote the software that made bank machines across the country pour out cash, and that the money went to the Tren de Aragua gang. He pleaded not guilty.
Story Highlights
- Canelon Aguirre, captured in Venezuela in September, pleaded not guilty to four federal conspiracy charges in Nebraska.
- Prosecutors say he led an ATM “jackpotting” ring and built the Ploutus software it used.
- Officials say crews hit bank machines in 47 states to raise money for Tren de Aragua.
- He is charged, not convicted, and will stay in custody until trial.
What Happened In Nebraska Federal Court
Canelon Aguirre, known by the nicknames “Prometheus” and “The Engineer,” made his first court appearance on Friday, October 2, in U.S. District Court in Nebraska, the Justice Department said. A grand jury there indicted him in December 2025. He pleaded not guilty to all four counts: conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, conspiracy to commit money laundering, and conspiracy to provide material support to terrorists. A judge ordered him held until trial. The bank fraud count carries the longest possible sentence, up to 30 years in prison.
Jackpotting is a kind of ATM theft. Thieves load harmful software, called malware, onto a cash machine, and the machine then hands out bills without taking the money from anyone’s account. Prosecutors say Canelon Aguirre built the malware used in these thefts, known as Ploutus, and was a main leader of the ring. According to the Justice Department, the software was written to block experts from studying it and to erase itself after a theft so bank workers would not find it.
The FBI added him to its Ten Most Wanted list in March 2026. He was the first person ever put there for computer crime and the 540th person on the list overall. Officials said he was caught in Venezuela in September and then brought to the United States. “Now he’s back in the United States to face justice,” FBI Director Kash Patel said.
How Agencies Link The Case To A Larger Network
Tren de Aragua began as a prison gang in Venezuela in the mid-2000s and has since spread across the Americas, including into the United States. The U.S. government lists it as a foreign terrorist organization. That is why one of the charges is support for terrorists: prosecutors say the stolen cash was meant to fund the gang.
The Treasury Department placed sanctions on Canelon Aguirre and nine other targets on Wednesday, September 30. Sanctions freeze any property a person holds in the United States and bar Americans from doing business with him. Treasury called him the alleged engineer of the malware and said the ring sent many crews into the United States to steal millions of dollars. Treasury also said jackpotting losses reported in the United States had reached $40.73 million across more than 1,500 attacks as of August 2025.
Court records from the Nebraska case, as reported in December 2025, tied the ring to at least 117 jackpotting attacks, with $5,401,181 in confirmed losses and another $1,429,738 in attempted thefts. The Justice Department says 120 people have now been charged in Nebraska in the wider investigation, and that machines were hit in 47 states and Washington, D.C. Three members of the ring have already been sentenced to between 78 and 96 months in prison.
Why This Case Matters Beyond One Defendant
The money in this case came out of ordinary bank and credit union machines, the same ones people use to pull out cash for groceries. Because the software does not charge any customer’s account, the loss falls on the bank or credit union that owns the machine. Officials say the thefts mix computer skill with old-fashioned burglary, since someone has to get hands on the machine to load the malware.
Patel said Canelon Aguirre is the 10th person from the Ten Most Wanted list captured since the start of the Trump administration. U.S. Attorney Lesley A. Woods, the top federal prosecutor in Nebraska, said, “There is nowhere that a terrorist indicted in the District of Nebraska can safely hide from justice.” The Justice Department also noted that an indictment is only an accusation and that every defendant is presumed innocent until proven guilty in court. No trial date has been announced.
Sources:
foxnews.com, home.treasury.gov, justice.gov, cwbchicago.com
