• DevelopingThree children die in Van Zandt County house fire; adult and child critically injured — 3 sources
  • New storyMotorcyclist dies in head-on collision with semi on U.S. 20 in LaPorte County
  • DevelopingMagnitude 7 earthquake reported in China; GDACS estimates 10,000 in MMI VII+ area — 2 sources
  • New storyCrash on Dixie Highway in Crestview Hills closes I-275 exit ramp
  • DevelopingNWS warns of severe thunderstorm with 60 mph gusts, large hail in parts of Arizona — 3 sources
  • DevelopingNWS warns of severe thunderstorm with 60 mph gusts, large hail in parts of Arizona — 2 sources
  • DevelopingMagnitude 7 earthquake reported in China; GDACS estimates 10,000 in MMI VII+ area — 1 source
  • New storyNWS warns of severe thunderstorm with 60 mph gusts, large hail in parts of Arizona
  • RenderingHurricane Utah flooding forces Gould Wash and WillowWind evacuations
  • New storyOne dead after crash into tree on Carl Baker Road in Starr, coroner says

Justice · ATM jackpotting

Cybercrime fugitive captured at sea; Nebraska ATM-theft case still awaits proof

Anibal Alexander Canelon Aguirre is detained in Nebraska after pleading not guilty. Prosecutors allege he supplied ATM-theft malware, but the capture details and financial accounting remain incomplete.

Aired Written 6 min read32 sourcesHeyDay News Desk · About usWatch report
Explore with HeyDex

Follow via RSS

Transcript · LOADING

Story trackerDay 3

1 report25 outlets32 sources1 video

  • No dated events yet
  1. Update 1Cybercrime fugitive captured at sea; Nebraska ATM-theft case still awaits proofYou are here

The Coast Guard has captured the FBI’s first cybercrime Ten Most Wanted fugitive, but bringing him into custody has not settled the case—or even reconciled the competing estimates of the money allegedly stolen. Anibal Alexander Canelon Aguirre is detained in Nebraska pending trial. He has pleaded not guilty to charges arising from an alleged ATM-jackpotting operation linked by prosecutors to Tren de Aragua. 1 4 5

The concrete breakthrough is a defendant before a court. Canelon Aguirre appeared before a federal magistrate judge in Nebraska on Friday, October 2, 2026, the day the Justice Department publicly announced his apprehension. Officials said the U.S. Coast Guard had captured him at sea and brought him to the United States. October 2 is not an established capture date. 1 2 4

He is 50 and also known as “Prometheus” and “The Engineer.” Prosecutors allege he developed malware used to make cash machines dispense money on command, then remotely directed crimes after the software was installed. The accusation puts him upstream of the crews collecting cash: not merely a participant at an individual ATM, but an alleged supplier and director of the means of theft. That role remains unproven. 1 2

Even the capture’s geography needs care. Newsweek and CRBC News describe him as captured in Venezuela; NewsNation describes an arrest in Nebraska. Those accounts are unreconciled. Nebraska’s established role as the court venue cannot be substituted for the location of the Coast Guard’s apprehension at sea. The exact maritime location, vessel, interception circumstances, capture date and transfer route have not been established. 6 15 11

Canelon Aguirre joined the Ten Most Wanted Fugitives list in March 2026 as its first cybercrime fugitive. WOWT’s March 12 coverage described his addition that Thursday, while a March 17 republication used “today”; the available material does not definitively establish the listing day. March reporting gave his age as 49, which is not necessarily inconsistent with the October announcement’s age of 50. 12 25 20 2

Software aimed at physical cash

“Jackpotting” here means malware causing an ATM to dispense cash on command. It is a cybercrime allegation with a physical target: money inside a machine. The available evidence does not establish that ordinary customers’ accounts or passwords were compromised. Nor does it identify the malware, explain how crews installed it, or establish its communications system and precise dispensing mechanism. 1 26

The described federal charges encompass bank fraud, money laundering, fraud offenses and material support. Those summaries are not a count-by-count account of the indictment. The accessible court-document excerpts contain a partial caption and defendant names, not the complete charging pages; the exact counts, statutes, indictment date and potential sentence have not been verified. 1 3 4 8

Nebraska U.S. Attorney Lesley A. Woods is the prosecutor identified with the announcement; her official Justice Department biography verifies that spelling. Officials said a judge ordered Canelon Aguirre held pending trial, but the complete plea minutes and detention order were not available for independent examination. The detailed grounds for detention are therefore unverified. Custody is not a finding of guilt. 1 28

The wider investigation, called Operation Zeus’s Revenge, involves the FBI, Homeland Security Investigations and Joint Task Force Vulcan. Officials said more than 120 people had been charged in Nebraska in connection with the crimes. That is a prosecution count, not a conviction count, and does not establish that all those people appear in Canelon Aguirre’s own indictment. The Coast Guard’s capture role is distinct from the investigation and prosecution. 1

The money does not reconcile

Key facts

  1. More than 120People charged in related Nebraska crimes 1
  2. ~$5.4mHSI’s estimated investigated-conspiracy losses 1
  3. ~$1.4mEstimated attempted losses, not completed thefts 1
  4. ~$61mBroader estimated bank thefts since 2021 1

The financial claims describe substantial alleged harm, but they do not form a single clean total. At the FBI Omaha press conference, the HSI account estimated approximately $5.4 million in losses associated with the investigated ATM-jackpotting conspiracy, plus approximately $1.4 million in attempted losses. Attempted losses are not cash established as stolen. 1

Officials also cited a broader estimate of approximately $61 million taken from American banks since 2021. The available account does not reconcile the accounting periods, incident inventories or precise coverage behind the $5.4 million and $61 million estimates. They should neither be added together nor treated as interchangeable. Neither establishes how much Canelon Aguirre personally received. 1

The distinction matters particularly to the alleged organizational benefit. Approximately half of the broader estimated proceeds was allegedly available for Tren de Aragua’s use. “Available” is not proof of a documented transfer to its leaders, money actually received, or expenditure on a particular activity. A material-support allegation must not do the work of proving a financing arrangement. 1

The practical stakes do not require inflating the numbers: the alleged operation removed cash from machines serving bank customers and exposed financial institutions to substantial losses. But no verified totals establish the number of affected banks or ATMs, money recovered or restitution paid. The loss estimates also do not establish that depositors personally bore those losses.

A decline is not a verdict

Officials described ATM-jackpotting attacks as declining. An unnamed FBI Omaha official went further on Nebraska, saying the state had experienced no successful attempt since Canelon Aguirre was charged. That is narrower than saying attempts stopped, attacks ended nationwide, or his apprehension caused the decline. The charging date, observation interval and underlying incident record are not established. 1

Charging, capture and court appearance are separate events. An improvement described as beginning at charging cannot automatically be credited to a later capture. The announcement offers a reported change in attack activity, not independently demonstrated causation.

The next consequential step is legal testing of the alleged remote direction, theft totals and organizational financing. No next-hearing or trial date has been verified. Canelon Aguirre remains detained pending trial; no conviction, final sentence, proven proceeds transfer or verified recovery of the missing money has been established. The capture ends a pursuit. It does not finish the proof. 1 4

Sources

FBI: Omaha press conference announcing Canelon Aguirre’s arrest. 1

Justice Department: October 2 apprehension and Nebraska court-appearance announcement. 2

CourtListener: partial indictment document. 3

Court Cast: Nebraska appearance and not-guilty pleas. 4

Fox News: cybercrime fugitive’s return and Nebraska charges. 5

Newsweek: capture of the first cybercrime Ten Most Wanted fugitive. 6

The North Platte Bulletin: alleged jackpotting organizer faces Nebraska prosecution. 7

PACERMonitor: indictment-document excerpt. 8

Columbus Telegram: ATM-scheme suspect in Nebraska court. 9

CRBC News: accused malware creator pleads not guilty. 10

NewsNation: Justice Department capture announcement. 11

WOWT: October 2 arrest coverage and broader loss estimate. 12

UPI: accused ATM-malware creator’s U.S. court appearance. 13

Traders Union: alleged cyber operative apprehended in Nebraska case. 14

CRBC News: fugitive returned to the United States. 15

KETV: arrest in Nebraska ATM-jackpotting investigation. 16

The Rio Times: Nebraska not-guilty pleas. 17

Ground News: aggregated Nebraska ATM-theft arrest coverage. 18

PublicNow: Nebraska U.S. Attorney’s Office apprehension-announcement republication. 19

Ottumwa Radio: March Ten Most Wanted announcement republication. 20

Nebraska.tv: authorities seek alleged international ATM-malware organizer. 21

LinkedIn: announcement of the Ten Most Wanted addition. 22

Texas Border Business: Ten Most Wanted listing coverage. 23

Fox News: first cybercrime addition to the fugitive list. 24

WOWT: March 12 listing coverage. 25

PressReleaseCloud: international ATM-jackpotting wanted announcement. 26

PublicNow: Justice Department apprehension-announcement republication. 27

Justice Department: Lesley A. Woods’s official biography. 28

Justice Department: District of Nebraska office website. 29

PublicNow: Woods’s advisory-committee appointment announcement. 30

Nebraska Examiner: Senate confirmation of Nebraska’s U.S. attorney. 31

Omaha World-Herald: Lesley Woods’s confirmation coverage. 32

As aired 12 lines
  1. The Coast Guard captured the FBI’s first cybercrime Ten Most Wanted fugitive at sea. The wider prosecution involves more than 120 people charged in Nebraska and millions in estimated bank losses. What does his capture establish—and what remains unproved about the thefts and alleged gang financing?
  2. Anibal Alexander Canelon Aguirre is now in federal custody in Nebraska. He is 50, also known as Prometheus and The Engineer, and accused of developing malware and remotely directing thefts from cash machines. A federal judge ordered him detained pending trial. That detention is not a conviction, and his alleged connection to Tren de Aragua remains unproven.
  3. Canelon Aguirre pleaded not guilty before a federal magistrate judge on Friday, October second, 2026. That is the established court-appearance date and the date of the public apprehension announcement—not a verified capture date. Nebraska U.S. Attorney Lesley A. Woods is the prosecutor identified with the announcement. The complete plea minutes and detention order have not been independently examined, and the detailed grounds for detention are not verified.
  4. The Coast Guard apprehension happened at sea; the court appearance happened in Nebraska. Those are different events. The location descriptions conflict: some place the capture in Venezuela, while another places an arrest in Nebraska. That discrepancy remains unresolved. The exact maritime location, capture date, vessel, interception circumstances and transfer route are not established. Nebraska’s confirmed role as the court venue cannot be substituted for the location of the apprehension.
  5. Canelon Aguirre entered the Ten Most Wanted Fugitives list in March 2026, as its first cybercrime fugitive. The exact listing day remains uncertain: contemporary coverage dated March twelfth described his addition that Thursday, while a March seventeenth republication used the word today. His age was given as 49 in March and 50 in October; those ages at different times are not necessarily contradictory.
  6. The alleged malware made ATMs dispense cash on command. That is what jackpotting means in this case. Canelon Aguirre’s accused role sits upstream of the people collecting the money: developing the software, then remotely directing crimes after installation. It is not simply an accusation that he took cash from one machine. The malware’s name, installation method, communications system and precise technical dispensing mechanism are not established. The described target was cash inside ATMs; no established finding shows that ordinary customers’ accounts or passwords were compromised.
  7. Canelon Aguirre faces numerous federal charges in the District of Nebraska. The available charge descriptions encompass bank fraud, money laundering, fraud offenses and material support. The indictment’s complete charging pages have not been independently examined, so the exact counts, statutes, indictment date and potential sentence are not verified. A material-support allegation does not itself prove that he financed the organization. Its correct name is Tren de Aragua, abbreviated TDA.
  8. More than 120 people had been charged in Nebraska in connection with the crimes by the announcement. That measures the scale of the prosecution, not the number convicted, and it does not establish that everyone appears in Canelon Aguirre’s own indictment. The investigation is called Operation Zeus’s Revenge. The FBI, Homeland Security Investigations and Joint Task Force Vulcan are among the enforcement bodies associated with it. Their investigative roles are distinct from the Coast Guard’s apprehension, and their involvement does not establish any individual defendant’s guilt.
  9. The investigated ATM-jackpotting conspiracy carries an estimated five-point-four million dollars in losses, plus approximately one-point-four million in attempted losses. Attempted losses are not money established as stolen. A separate, broader estimate puts money taken from American banks since 2021 at approximately 61 million dollars. The smaller and larger estimates have unreconciled accounting periods, incident inventories and precise coverage. They must not be added together or treated as interchangeable, and neither figure establishes how much Canelon Aguirre personally received.
  10. Approximately half of those broader estimated proceeds was allegedly available for TDA’s use. Available is not the same as a documented transfer to its leaders, money actually received, or spending on a particular activity. The amounts remain investigative estimates, and the proposed organizational benefit remains an allegation. The practical stakes are cash removed from machines serving bank customers and substantial exposure for financial institutions. No verified totals establish the number of affected ATMs or banks, money recovered, or restitution paid. Nor do the loss estimates establish that depositors personally bore those losses.
  11. Nebraska has a reported record of no successful jackpotting attempt since Canelon Aguirre was charged. Attacks were also described as declining. But no successful attempt is narrower than no attempts at all, and a Nebraska observation does not establish that attacks ended nationwide. The charging date, observation interval and underlying incident record are not established. Charging, capture and court appearance are separate events: an improvement described as beginning at charging cannot automatically be credited to his later apprehension.
  12. The capture establishes custody and brings Canelon Aguirre before the court that will test the case. It does not establish guilt, the alleged remote direction, the theft totals or a financing arrangement with TDA. No proven proceeds transfer or verified recovery of the missing money has been established. He remains detained pending trial, and no verified next-hearing or trial date is available.

Sources

32 sources25 outlets1 video

Source map

Follow the evidence behind this report. The map shows its connections; the links below open the sources cited in this article.

Source map loads as you read.

Explore the full newsroom map ↗

Revision log

  1. r1First published.