Justice · ATM jackpottingFBI’s first cybercrime Most Wanted fugitive captured at sea, pleads not guiltyAired October 5, 2026 at 1:31 AM UTCWritten October 5, 2026 at 1:41 AM UTCRead the write-upThis storyTranscript · LOADING0:09The Coast Guard captured the FBI's first cybercrime 10 Most Wanted Fugitive at Sea.0:14The wider prosecution involves more than 120 people charged in Nebraska and millions0:19in estimated bank losses.0:20What does his capture establish, and what remains unproved about the thefts and0:24alleged gang financing?0:25Annibal Alexander Kenilan Aguirre is now in federal custody in Nebraska.0:30He is 50, also known as Prometheus and the Engineer, and accused of developing0:35malware and remotely directing thefts from cash machines.0:38A federal judge ordered him detained pending trial.0:41That detention is not a conviction, and his alleged connection to Trenda Aragua0:45remains unproven.0:46Canilon Aguirre pleaded not guilty before a federal magistrate judge on Friday,0:50October 2nd, 2026.0:52That is the established court appearance date and the date of the public0:55apprehension announcement.0:57Not a verified capture date.0:58Nebraska U.S.0:59Attorney Leslie A.1:00Woods is the prosecutor identified with the announcement.1:03The complete plea minutes and detention order have not been independently examined1:07and the detailed grounds for detention are not verified.1:09The Coast Guard apprehension happened at sea, the court appearance happened in1:13Nebraska.1:14Those are different events.1:15The location descriptions conflict.1:17Some place the capture in Venezuela, while another places an arrest in Nebraska.1:22That discrepancy remains unresolved.1:24The exact maritime location, capture date, vessel, interception circumstances, and1:29transfer route are not established.1:31Nebraska's confirmed role as the court venue cannot be substituted for the location1:35of the apprehension.1:37Canelon Aguirre entered the 10 Most Wanted Fugitives list in March 2026 as its first1:42cybercrime fugitive.1:44The exact listing day remains uncertain.1:47Contemporary coverage dated March 12th described his edition that Thursday while a1:51March 17th republication used the word today.1:54His age was given as 49 in March and 50 in October.1:58Those ages at different times are not necessarily contradictory.2:01The alleged malware made ATMs dispense cash on command.2:05That is what jackpotting means in this case.2:07Canelon Aguirre's accused role sits upstream of the people collecting the money.2:11developing the software, then remotely directing crimes after installation.2:15It is not simply an accusation that he took cash from one machine.2:19The malware's name, installation method, communication system, and precise technical2:24dispensing mechanism are not established.2:26The described target was cash inside ATMs.2:29No established finding shows that ordinary customers' accounts or passwords were2:32compromised.2:32Canelan Aguirre faces numerous federal charges in the District of Nebraska.2:37The available charge descriptions encompass bank fraud, money laundering, fraud2:40offenses, and material support.2:42The indictment's complete charging pages have not been independently examined, so2:46the exact counts, statutes, indictment date, and potential sentence are not2:49verified.2:50A material support allegation does not itself prove that he financed the2:53organization.2:54Its correct name is Tren de Aragua, abbreviated TDA.2:58More than 120 people had been charged in Nebraska in connection with the crimes by3:02the announcement.3:03That measures the scale of the prosecution, not the number convicted, and it does3:07not establish that everyone appears in Canelan Aguirre's own indictment.3:11The investigation is called Operation Zeus's Revenge.3:14The FBI, Homeland Security Investigations, and Joint Task Force Vulcan are among the3:18enforcement bodies associated with it.3:20Their investigative roles are distinct from the Coast Guard's apprehension, and3:24their involvement does not establish any individual defendant's guilt.3:27The investigated ATM jackpotting conspiracy carries an estimated $5.4 million in3:32losses, plus approximately $1.4 million in attempted losses.3:36Attempted losses are not money established as stolen.3:39A separate broader estimate puts money taken from American banks since 2021 at3:43approximately $61 million.3:45The smaller and larger estimates have unreconciled accounting periods, incident3:49inventories, and precise coverage.3:52They must not be added together or treated as interchangeable, and neither figure3:56establishes how much Canilon Aguirre personally received.3:59Approximately half of those broader estimated proceeds was allegedly available for4:03TDA's use.4:04Available is not the same as a documented transfer to its leaders, money actually4:08received or spending on a particular activity.4:11The amounts remain investigative estimates and the proposed organizational benefit4:14remains an allegation.4:15The practical stakes are cash removed from machines serving bank customers and4:20substantial exposure for financial institutions.4:22No verified totals establish the number of affected ATMs or banks, money recovered,4:27or restitution paid, nor do the loss estimates establish that depositors personally4:31bore those losses.4:32Nebraska has a reported record of no successful jackpotting attempt since Canilan4:36Aguirre was charged.4:37Attacks were also described as declining, but no successful attempt is narrower than4:42no attempts at all, and a Nebraska observation does not establish that attacks ended4:46nationwide.4:47The charging date, observation interval, and underlying incident record are not4:51established.4:52Charging, capture, and court appearance are separate events.4:55An improvement described as beginning at charging cannot automatically be credited4:59to his later apprehension.5:00The capture establishes custody and brings Canilon Aguirre before the court that5:05will test the case.5:06It does not establish guilt.5:08The alleged remote direction, the theft totals, or a financing arrangement with TDA,5:12no proven proceeds transfer or verified recovery of the missing money has been5:16established.5:16He remains detained pending trial, and no verified next hearing or trial date is5:21available.Explore with HeyDexFollow via RSSThe shortThe short ↗