The U.S. Department of Justice (DoJ) has taken another major step in dismantling a sprawling international criminal network accused of stealing millions of dollars from ATM machines across the country. On January 26, a federal grand jury in Nebraska returned an indictment charging 31 additional individuals in what authorities describe as a nationwide “ATM jackpotting” conspiracy. These latest charges bring the total number of defendants in the case to 87 people facing federal offenses related to the scheme.
What Is ATM Jackpotting?
ATM jackpotting is a form of cyber-assisted theft in which criminals force cash machines to dispense large amounts of money without any legitimate transaction. Instead of stealing from a bank account, the attackers manipulate the ATM’s internal computer system using specialized malware. In this conspiracy, the malware known as Ploutus was allegedly at the center of the thefts. Investigators say the software allowed perpetrators to issue unauthorized commands to the ATM’s cash dispenser, effectively turning the machines into digital slot machines that spit out cash on demand.
How the Scheme Worked
According to law enforcement officials, the criminal ring operated with a high degree of coordination and planning:
- Members of the group would first scout target ATMs, often in discreet or low-traffic locations.
- They would then physically open the machines’ external casings to check for alarms or signs of law enforcement presence.
- If no response was triggered, they either installed malware directly onto the ATM’s hard drive or connected devices (like thumb drives) to deploy the Ploutus code. Once activated, the malware took control of the ATM’s cash module, causing it to release funds.
The Department of Justice reports that between February 2024 and December 2025, the group stole at least $5.4 million from more than 60 machines, primarily belonging to smaller banks and credit unions.
Connections to Tren de Aragua
A significant feature of this investigation has been the alleged involvement of members of Tren de Aragua (TdA), a gang that originated in Venezuelan prisons and has grown into an international criminal organization. U.S. prosecutors have described the group not just as a criminal syndicate but as a foreign terrorist organization, accusing it of participating in violent crimes including human trafficking, kidnapping, and murder.
Many of the charged defendants are Venezuelan and Colombian nationals, with some allegedly affiliated with TdA. Prosecutors allege that proceeds from the jackpotting operation were funneled back to support the gang’s broader criminal activities.
Legal Charges and Potential Penalties
The newly filed indictment includes multiple counts, such as:
- Conspiracy to commit bank fraud
- Bank burglary
- Computer fraud
- Unauthorized access to protected computers
If convicted, the defendants could face decades in prison under federal sentencing guidelines. Authorities emphasize that this case represents one of the broader efforts in recent years to combat sophisticated financial crimes that exploit both physical vulnerabilities and digital malware.
Ongoing Crackdown and Broader Context
This latest wave of charges comes on the heels of earlier indictments filed in late 2025. In December, federal prosecutors charged 54 individuals in connection with related jackpotting operations, part of the same overarching conspiracy that stretched across numerous states.
Experts note that ATM jackpotting, though not new, has grown more complex with the evolution of malware like Ploutus, which has been active globally for more than a decade. Authorities across the U.S. have issued warnings about this type of crime as law enforcement agencies work to stay ahead of increasingly sophisticated threats targeting financial infrastructure.
