FBI's First Cyber Fugitive on Ten Most Wanted List Returned to US After Venezuela Capture
Anibal Alexander Canelon Aguirre, the FBI's first cyber fugitive ever placed on its Ten Most Wanted list, appeared in a Nebraska courtroom Friday after his capture in Venezuela, facing charges in a multimillion-dollar ATM jackpotting scheme tied to Tren de Aragua.
A Venezuelan man accused of leading a multimillion-dollar ATM jackpotting conspiracy for the Tren de Aragua gang appeared in a Nebraska federal courtroom Friday, becoming the first cyber fugitive ever placed on the FBI's Ten Most Wanted list to be returned to U.S. soil, according to the Department of Justice.
Anibal Alexander Canelon Aguirre, 50, who authorities say is also known as «Prometheus» and «The Engineer,» pleaded not guilty to four federal conspiracy charges during his initial appearance. He will remain detained in Nebraska while awaiting trial, the DOJ said.
The charges include conspiracy to commit bank fraud, bank burglary and computer fraud, money laundering, and providing material support to terrorists. The bank fraud conspiracy count carries the highest maximum penalty at 30 years in prison.
FBI Director Kash Patel touted the return as the 10th Ten Most Wanted fugitive captured since the beginning of the Trump administration and the first cyber fugitive ever placed on the list. «Now he's back in the United States to face justice,» Patel said. «This FBI is running on supercharged horsepower — and there is nowhere on this planet criminals can hide.»
Patel said the 10 captures are more than two and a half times the total recorded during the previous four years. Aguirre was apprehended last month in Venezuela, after which Patel told lawmakers the FBI had captured one of the nation's top fugitives.
Prosecutors allege that Canelon Aguirre developed malicious software and served as one of the leaders of an international conspiracy to steal millions of dollars from financial institutions in support of Tren de Aragua through an ATM jackpotting scheme dating to at least 2024.
An ATM jackpotting attack is a type of cyberattack in which criminals exploit vulnerabilities in an ATM, including through the use of malware, to force the machine to dispense cash, according to the DOJ.
The broader ATM jackpotting conspiracy has been linked to Tren de Aragua, which the United States has designated as a foreign terrorist organization. Attorney General Todd Blanche said the DOJ has charged nearly 350 alleged TdA members and associates since the designation.
«The capture and arrest of Anibal Alexander Canelon Aguirre marks yet another success for the Homeland Security Task Force and Joint Task Force Vulcan,» Blanche said. «We will continue to break up narcoterrorist finance networks, prosecute violent criminals, and keep American neighborhoods safe.»
The case highlights the growing intersection of transnational gang activity and cyber-enabled financial crime, as federal authorities pursue networks they say use sophisticated hacking tools to fund violent operations. The FBI has previously pointed to Aguirre as a central figure in a scheme that targeted financial institutions across the United States.
Aguirre's capture in Venezuela followed a months-long manhunt that placed him among the bureau's most sought-after fugitives. His placement on the Ten Most Wanted list marked the first time the FBI had elevated an alleged cybercriminal to that roster, reflecting what officials describe as the evolving threat posed by digital crime groups.
Federal prosecutors in Nebraska are handling the case, which will proceed through the U.S. District Court following Friday's arraignment. No trial date has been announced.
8
