Venezuelan men sentenced in ATM “jackpotting” scheme that hit Seattle banks, tied to Tren de Aragua

Two Venezuelan men were sentenced Thursday to 78 months in federal prison for their roles in a sprawling conspiracy that used malware to steal millions of dollars from ATMs across the U.S., including in Washington, the Justice Department said.

Carlos Javier Padron, 36, who prosecutors said is in the country illegally, took part in a transnational scheme known as “ATM jackpotting,” in which criminals force cash machines to dispense the money inside them. His co-defendant, 37-year-old Oddry Arnoldo Cabrera Torrealba — who also went by the name Luis Alejandro Berdugo Barraza — received the same 78-month sentence on June 11.

Both men are from Venezuela, and prosecutors said both are in the U.S. illegally.

According to court documents, Padron and Cabrera Torrealba were part of a sophisticated network responsible for ATM jackpottings throughout the country. The group developed and deployed a variant of malware called Ploutus, which the men installed on machines in person. Once activated, the malware lets conspirators command an ATM’s cash-dispensing module to spit out currency. The program was also designed to erase evidence of itself so banks could not detect it.

The Lincoln, Nebraska, Police Department arrested the two men at the scene of a jackpotting in October 2024. Both later pleaded guilty to conspiracy to commit bank burglary, computer fraud, and intentional damage to a protected computer. At sentencing, a judge ordered them to jointly pay more than $1.5 million in restitution to multiple victim banks.

The scheme touched the Pacific Northwest. Court records showed jackpotting incidents tied to the network in Washington state and Eastern Oregon, and the Walla Walla and Milton-Freewater police departments were among dozens of agencies that assisted in the investigation. The Seattle FBI office and the U.S. Attorney’s Office for the Western District of Washington also provided help.

The case is far from over

Since the two arrests, 96 more defendants have been indicted on charges that include bank burglary, money laundering, bank fraud, and providing material support to a designated foreign terrorist organization.

Investigators said the conspiracy is tied to Tren de Aragua, a violent gang that began as a prison operation in Venezuela in the mid-2000s and has since spread across the Western Hemisphere and into the United States. The group is known for drug and firearms trafficking, sex trafficking, kidnapping, robbery, and extortion, and authorities said it has increasingly turned to financial crimes like jackpotting to fund its operations.

“ATM jackpotting is TdA’s business plan and their assessed primary source of revenue to fund their terrorist activities,” said U.S. Attorney Lesley Woods for the District of Nebraska. She said the prosecutions are meant to “put a chokehold on their funding pipeline.”

Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division said the men “helped deploy sophisticated malware as part of a transnational criminal network that hacked ATMs across the United States and stole millions of dollars.” He said the investigation, led out of Nebraska, has “disrupted this network at all levels.”

FBI Special Agent in Charge Eugene Cowel of the Omaha Field Office said the bureau would keep working to “dismantle and disrupt the activities of TdA locally and globally.”

The FBI’s Omaha Field Office and Homeland Security Investigations are leading the case, with help from dozens of federal, state, and local agencies nationwide. Prosecutors said the effort is part of a broader Homeland Security Task Force initiative targeting cartels, foreign gangs and trafficking rings, as well as Joint Task Force Vulcan, a unit originally created to combat MS-13 and later expanded to go after Tren de Aragua.

Manda Factor is the host of “Seattle’s Morning News” on KIRO Newsradio. Follow Manda on X and email her here. 

Follow @MandaFactor