U.S. authorities have arrested Anibal Alexander Canelon Aguirre, the Venezuelan national accused of developing the Ploutus malware used to force ATMs to dispense cash, BleepingComputer reported Monday. The Justice Department announced the arrest, and he has appeared in a U.S. court to face charges filed in Nebraska last year.

What Happened

Canelon Aguirre, 50, is known by the aliases "Prometheus" and "The Engineer." He was charged in Nebraska in December 2025, and in March 2026 he became the first cybercriminal added to the FBI's Ten Most Wanted Fugitives list.

The Justice Department describes him as the developer of Ploutus and a principal leader of the conspiracy. He faces four charges:

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says
  • conspiracy to commit bank fraud, with a maximum sentence of 30 years
  • conspiracy to commit money laundering, with a maximum of 20 years
  • conspiracy to commit bank burglary and computer fraud, with a maximum of five years
  • conspiracy to provide material support to terrorists, with a maximum of 15 years

BleepingComputer's report does not say where or when he was taken into custody, and it gives no date for his next court appearance.

The Alleged Scheme

According to court documents cited by BleepingComputer, Canelon Aguirre and his accomplices used Ploutus to empty bank and credit union ATMs between February 2024 and December 2025. Prosecutors say more than $5.4 million was stolen in at least 63 jackpotting attacks against banks and 54 against credit unions, with a further $1,429,738 in attempted thefts. Average losses exceeded $100,000 per incident.

Investigators say the conspiracy targeted or hit ATMs in 47 states, the District of Columbia and several other countries. Prosecutors allege that the proceeds were laundered and sent to accounts controlled by Tren de Aragua, the Venezuelan gang that the United States has designated a foreign terrorist organization. That link underpins the material support charge.

Why It Matters

The arrest marks a turn in a case The Primary Wire covered last week. When Treasury's Office of Foreign Assets Control sanctioned Canelon Aguirre and seven associates Sept. 30, he was still listed as a fugitive. Days later, he is in U.S. custody.

Jackpotting attacks do not touch customer accounts; criminals tamper with the machine itself, install malware and command it to pay out its cash. Ploutus has been used for more than a decade, and U.S. prosecutors have tied recent jackpotting waves to Tren de Aragua. Charging the alleged author of the malware, rather than only the crews who visit the machines, targets the person prosecutors say supplied the tool behind the operation.

The case is part of a wider push against the gang. BleepingComputer reported that 98 suspects linked to Tren de Aragua have been charged since October 2025.

What to Watch

Further proceedings will take place in the Nebraska case. Details still to emerge include where Canelon Aguirre was arrested, whether he was extradited or detained in the United States, and whether he will contest the charges.

For banks and credit unions, the case highlights the physical side of ATM security, including access to the machine's internal computer, which jackpotting crews must reach to install malware.