Two Venezuelans sentenced to 78 months in ATM jackpotting scheme tied to TdA

Two Venezuelan nationals were sentenced to 78 months in federal prison for their roles in a transnational conspiracy that used malware to steal millions of dollars from ATMs across the United States, the Justice Department announced.

Carlos Javier Padron, 36, an illegal alien from Venezuela, was sentenced for his role in the scheme, which is commonly known as “ATM jackpotting,” authorities said. His co-defendant, Oddry Arnoldo Cabrera Torrealba, 37, also known as “Luis Alejandro Berdugo Barraza,” was sentenced June 11 to the same prison term for similar conduct, according to the Justice Department.

Officials said the men helped deploy a sophisticated malware variant known as Ploutus as part of a broader criminal network that investigators said has extensive links to Tren de Aragua, a violent transnational criminal organization. Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division said the pair helped hack ATMs nationwide, causing machines to dispense cash directly, and said crimes like these fuel the operations of violent transnational criminal organizations such as TdA.

U.S. Attorney Lesley Woods for the District of Nebraska said ATM jackpotting is TdA’s assessed primary source of revenue for activities ranging from human trafficking and armed robbery to murder and drug trafficking, and said prosecutors intend to “put a chokehold” on that funding pipeline. FBI Omaha Field Office Special Agent in Charge Euguene Cowel said the bureau will continue working with federal, state and local partners to dismantle and disrupt TdA’s activities both domestically and globally.

According to court documents, Padron and Torrealba were part of a sophisticated criminal network responsible for ATM jackpotting operations throughout the United States. The conspiracy relied on individuals including the two men to install Ploutus malware directly onto ATMs, allowing co-conspirators to issue remote commands to the machines’ cash-dispensing modules and force unauthorized withdrawals. The malware was also designed to delete evidence of its presence to help prevent financial institutions from detecting its use, court documents state. The pair were arrested by the Lincoln, Nebraska, Police Department at the site of a jackpotting incident in October 2024.

Both men pleaded guilty to one count of conspiracy to commit bank burglary and one count of computer fraud and intentional damage to a protected computer, prosecutors said. The court also ordered them to jointly pay $1,537,696 in restitution to multiple victim banks.

Since their arrests, 96 additional defendants have been indicted in connection with the broader conspiracy, facing charges that include material support to a designated foreign terrorist organization, bank burglary, money laundering, damage and unauthorized access to protected computers, bank fraud and conspiracy-related offenses, the Justice Department said. Investigators said they identified extensive direct and indirect links between the network and TdA, which originated as a Venezuelan prison gang in the mid-2000s and has since expanded throughout the Western Hemisphere into crimes including drug trafficking, firearms trafficking, commercial sex trafficking, kidnapping, robbery, theft, fraud, extortion and violent offenses, according to court documents.