TOPEKA, KAN – After a Federal Bureau of Investigation (FBI) investigation, five Venezuelan nationals admitted guilt in attempting to steal U.S. currency from automated teller machines (ATMs), federal prosecutors announced Monday.
U.S. Attorney Ryan A. Kriegshauser is encouraging banks and other financial institutions to take a proactive approach to guard against a criminal activity known as “jackpotting”, which is becoming more prevalent. Jackpotting involves installing malware into an ATM to force it to dispense sizeable amounts of money.
According to an FBI report released in February 2026, crimes involving ATM jackpotting are increasing across the country.
The FBI reports 1,900 incidents since 2020.
In 2025 alone, there were over 700 incidents with more than $20 million in losses.
According to court documents, Luis Alberto Velasquez-Artigas, 27, Royder Adrian Figuera-Perez, 29, Javier Mejia, Jr, 27, Gabriel Alexjandro Corales-Garcia, 33, and Italo Lizandro Corrales-Carrillo, 26, all pleaded guilty to one count of conspiracy to commit bank larceny.
In December 2025, the defendants traveled from Indiana to Kansas to attempt to steal cash from ATMs in Wamego and Manhattan through jackpotting.
Their plan was for one conspirator to physically install the malware into the ATMs then later for the group to remotely activate a command causing the ATMs to dispense cash that they would go collect.
The conspirators were unsuccessful in installing the malware on the ATM in Wamego, but their attempts at installing the malware triggered the alarm causing law enforcement to respond, and the culprits didn’t return to the site.
In Manhattan, the group was equally unsuccessful in getting the ATM to dispense money.
Both attempted thefts were captured by surveillance cameras, and the perpetrators were arrested a few days later.
Alleged Nationwide ATM Jackpotting Scheme
Federal prosecutors allege the conspiracy recruited crews to install Ploutus malware in ATMs nationwide, forcing the machines to dispense cash without authorized transactions.
According to court documents, crews linked to Tren de Aragua, or TdA, traveled in groups to targeted banks and credit unions. They surveyed security systems, opened ATM access panels and waited nearby to determine whether they had triggered alarms or drawn a police response.
The crews allegedly installed Ploutus by modifying or replacing ATM hard drives or connecting external devices, such as thumb drives. The malware issued unauthorized commands to the machine’s cash dispenser and could delete evidence of the intrusion. Prosecutors said conspirators divided the stolen money according to predetermined shares.
A Dec. 9, 2025, indictment charged 22 people in an alleged nationwide scheme involving bank fraud, bank burglary, computer crimes, money laundering and material support for terrorism. Prosecutors allege TdA used jackpotting to steal millions of dollars and transferred the proceeds among members and associates to conceal their source.
A related 56-count indictment returned Oct. 21, 2025, charged 32 people with bank fraud, bank burglary, computer damage and conspiracy offenses.
If convicted, the defendants face maximum prison terms ranging from 20 to 335 years. Actual sentences would be determined by federal judges after considering sentencing guidelines and other statutory factors.
Federal authorities describe TdA as a violent transnational criminal organization that began as a Venezuelan prison gang in the mid-2000s and later expanded across the Western Hemisphere. Court documents link the organization to drug and firearms trafficking, commercial sex trafficking, kidnapping, robbery, fraud, extortion, assault and murder.
Over six months, the Justice Department charged 87 alleged TdA members and leaders with offenses that included material support for terrorism, bank burglary, money laundering, computer crimes and bank fraud.
🔴 Quick Fact Checklist
🔴 Malware used: Ploutus.
🔴 Target: ATMs operated by banks and credit unions nationwide.
🔴 Method: Crews allegedly modified ATM hard drives or connected malware-loaded external devices.
🔴 Purpose: Force ATMs to dispense cash without authorized transactions.
🔴 Concealment: The malware could delete evidence of the intrusion.
🔴 Dec. 9 indictment: Twenty-two defendants charged.
🔴 Oct. 21 indictment: Thirty-two defendants charged in 56 counts.
🔴 Alleged proceeds: Millions of dollars.
🔴 Six-month total: The Justice Department charged 87 alleged TdA members and leaders.
🔴 Case status: The charges are allegations. The defendants are presumed innocent unless proven guilty in court.