“The Engineer”: FBI Offers $1 Million in Hunt for Alleged ATM Jackpotting Mastermind Anibal Canelon Aguirre
FBI Ten Most Wanted Fugitive
Anibal Alexander Canelon Aguirre is wanted by the FBI for allegedly leading a large international conspiracy that sent crews into the United States to steal millions of dollars from financial institutions using sophisticated attacks against automated teller machines.
Federal authorities allege that the operation supported Tren de Aragua, the Venezuelan-origin transnational gang designated by the United States as a foreign terrorist organization. The FBI is offering a reward of up to $1 million for information leading directly to Canelon Aguirre’s arrest.
On March 12, 2026, Canelon Aguirre became the 540th person added to the FBI’s Ten Most Wanted Fugitives list. His addition was particularly significant because the FBI identified him as the first cyber fugitive ever placed on the Ten Most Wanted list.
Alleged Leader of an International Financial Crime Network
According to the FBI, Canelon Aguirre allegedly occupied a leadership position in a large international conspiracy targeting financial institutions across the United States.
Rather than personally carrying out every theft, authorities allege that the conspiracy deployed numerous crews into the country. Those groups allegedly targeted ATMs and extracted cash using a technique commonly called ATM jackpotting.
The operation allegedly generated millions of dollars in stolen funds. Investigators accuse Canelon Aguirre and other members of the conspiracy of using those crimes to unlawfully enrich themselves while supporting Tren de Aragua.
How ATM Jackpotting Works
ATM jackpotting is a form of cyber-enabled financial crime in which criminals compromise an automated teller machine and cause it to dispense cash without authorization.
In the alleged conspiracy involving Canelon Aguirre, federal authorities say malware was installed on ATMs. Once the malicious software compromised the machines, the attackers could allegedly force them to dispense cash.
The technique differs from traditional ATM theft involving physically breaking open a machine. Jackpotting instead involves compromising the computer systems controlling an ATM so criminals can manipulate its normal operation and cause unauthorized cash withdrawals.
Malware Allegedly Used Against ATMs
Malware is a central element of the allegations against Canelon Aguirre. Federal investigators accuse members of the conspiracy of installing malicious software on ATMs to manipulate the machines.
Once compromised, an ATM could allegedly be forced to dispense money to members of the criminal crews. The process allowed participants to extract cash directly from financial institutions without conducting legitimate customer withdrawals.
The allegations illustrate how conventional financial crimes can increasingly overlap with cybercrime. Instead of relying exclusively on physical burglary, criminal groups can allegedly combine technical attacks with crews responsible for accessing machines and collecting stolen cash.
Millions Allegedly Stolen From Financial Institutions
The FBI alleges that the international conspiracy has stolen millions of dollars from financial institutions in the United States.
According to federal authorities, the criminal activity has been occurring since at least January 2024. Multiple crews were allegedly deployed to carry out jackpotting attacks against ATMs.
The scale of the operation ultimately attracted the attention of federal investigators specializing in organized crime, terrorism-related offenses, money laundering, and computer crime.
Stolen Cash Allegedly Entered Money Laundering Network
The alleged operation did not end when cash was removed from an ATM. Federal authorities accuse the conspiracy of moving the stolen money through a complex laundering network afterward.
Money laundering is generally intended to conceal or disguise the origin, ownership, movement, or control of funds generated through criminal activity. In a large organized operation, laundering networks can make it more difficult for investigators to trace proceeds back to the original crime.
Canelon Aguirre consequently faces a federal charge of conspiracy to commit money laundering in addition to charges involving bank fraud and attacks against protected computer systems.
Alleged Connection to Tren de Aragua
Federal investigators allege that the ATM operation supported Tren de Aragua, commonly abbreviated as TdA.
The organization originated in Venezuela before expanding throughout Latin America and into the United States. U.S. authorities have pursued numerous investigations involving individuals accused of participating in or supporting the organization.
The FBI alleges that Canelon Aguirre’s conspiracy deployed crews into the United States to steal money from financial institutions in support of the gang. This alleged connection significantly broadened the federal case beyond a conventional bank fraud or computer intrusion investigation.
Material Support Charge
Among the federal charges against Canelon Aguirre is conspiracy to provide material support to terrorists.
That allegation reflects the government’s contention that the criminal enterprise was connected with Tren de Aragua and provided support benefiting the organization.
Canelon Aguirre has not been convicted of these offenses. The charges remain allegations unless and until prosecutors establish them through the federal judicial process.
Federal Arrest Warrant Issued in Nebraska
On December 9, 2025, a federal arrest warrant was issued for Canelon Aguirre by the U.S. District Court for the District of Nebraska in Omaha.
The federal charges include conspiracy to commit bank fraud; conspiracy to commit bank burglary and intentionally damage a protected computer system; conspiracy to commit money laundering; and conspiracy to provide material support to terrorists.
Because Canelon Aguirre remains outside federal custody, authorities are seeking his apprehension so he can be brought before the court to answer the charges.
First Cyber Fugitive on FBI Ten Most Wanted List
Canelon Aguirre reached a historic distinction within the FBI’s Ten Most Wanted program when he was added to the list on March 12, 2026.
According to the FBI, he became the first cyber fugitive ever selected for the Ten Most Wanted Fugitives list. He was also the 540th fugitive added since the program was established in 1950.
His inclusion reflects the changing nature of major federal fugitive investigations. Cyber-enabled crimes can now intersect with organized crime, financial fraud, money laundering, and national security investigations in ways that were uncommon when the Ten Most Wanted program was created.
FBI Description of Anibal Canelon Aguirre
According to the FBI, Canelon Aguirre was born on May 15, 1976, in Venezuela. He is a Venezuelan national.
The FBI describes him as a Hispanic male with black and gray hair and brown eyes. He is approximately 5 feet 5 inches to 5 feet 7 inches tall and weighs approximately 190 pounds.
The photographs currently distributed by the FBI were taken in 2023. Because time has passed since those photographs were taken, his weight, hairstyle, facial hair, or other aspects of his appearance could have changed.
Known as “Prometheus” and “The Engineer”
The FBI lists several aliases associated with Canelon Aguirre. Two of the most distinctive are “Prometheus” and “The Engineer.”
Additional names associated with him include Anibal Alexander Aguirre, Anibal A. Canelon-Aguirre, and Anibal Alexander Canelon.
These aliases could be particularly important in a case involving international organized crime and cyber-enabled activity. Someone may know Canelon Aguirre through an alternate identity without recognizing the full name appearing on his federal wanted notice.
Ties to Venezuela and Mexico
The FBI states that Canelon Aguirre has ties to both Venezuela and Mexico.
Those international connections expand the potential geographic scope of the fugitive investigation. Authorities may need to consider residences, associates, travel routes, businesses, financial activity, and communications extending beyond the United States.
Individuals in either country who have encountered someone matching Canelon Aguirre’s description or using one of his aliases could potentially possess information relevant to investigators.
Spanish-Speaking Venezuelan National
The FBI identifies Canelon Aguirre as a Venezuelan national and states that he is known to speak Spanish.
His international background and connections to multiple countries are important considerations in the investigation because they could allow him to rely on established personal or professional networks outside the United States.
Investigators may be interested in information concerning travel documents, residences, employment, telephone numbers, online accounts, financial relationships, or associates connected with him.
Joint Task Force Vulcan Investigation
The investigation is being conducted as part of Joint Task Force Vulcan, a federal initiative focused on combating significant transnational criminal organizations.
The task force approach allows federal agencies and prosecutors to combine resources when investigating organizations whose activities cross traditional investigative boundaries.
In this case, the allegations involve organized crime, cyber-enabled attacks against financial institutions, money laundering, and alleged support for Tren de Aragua.
Department of Justice Cybercrime Specialists Involved
The Department of Justice’s Computer Crime and Intellectual Property Section, commonly known as CCIPS, is also involved in the investigation.
CCIPS specializes in federal cases involving computer intrusions, cybercrime, intellectual property offenses, and other technology-related criminal activity.
Its participation reflects the technical nature of the ATM jackpotting allegations. Investigators are not dealing solely with stolen cash but with an alleged operation involving malware and intentional damage to protected computer systems.
Omaha FBI Handles the Fugitive Case
The FBI’s Omaha Field Office is responsible for Canelon Aguirre’s wanted investigation.
The connection to Omaha stems from the federal prosecution in the District of Nebraska. Investigators continue seeking information that could establish Canelon Aguirre’s current location or identify individuals and networks assisting him.
Because he has ties outside the United States, information concerning the case could potentially come from several countries.
Considered Armed and Dangerous
The FBI warns that Canelon Aguirre should be considered armed and dangerous.
Anyone who believes they recognize him should not approach, confront, follow, detain, or attempt to apprehend him. A suspected sighting should instead be reported directly to law enforcement.
Providing investigators with specific information—including a location, vehicle, residence, associate, telephone number, business, or other identifying detail—can allow authorities to evaluate a lead without unnecessarily placing members of the public in danger.
Digital Information Could Help Investigators
Because this case involves alleged cyber-enabled crime, information about Canelon Aguirre does not necessarily have to involve a physical sighting.
People who recognize one of his aliases, online identities, telephone numbers, email addresses, financial accounts, or other digital connections may possess information potentially relevant to investigators.
Individuals should not attempt to access private accounts, hack systems, or conduct their own investigation. Any lawfully obtained information should instead be provided to authorities, who can determine whether it is connected to the federal case.
Associates and Support Networks May Provide Leads
Investigators may also be interested in individuals who have maintained contact with Canelon Aguirre or provided resources enabling him to remain outside federal custody.
Information concerning transportation, residences, identification documents, communications, financial support, employment, or other assistance could potentially help authorities determine his location.
Even an older connection can matter. A previous associate may lead investigators to newer contacts, locations, businesses, or communications that help establish a more recent picture of his movements.
$1 Million FBI Reward
The FBI is offering a reward of up to $1 million for information leading directly to the arrest of Anibal Alexander Canelon Aguirre.
The reward accompanies the FBI’s increased publicity surrounding his placement on the Ten Most Wanted Fugitives list. Authorities hope that distributing his photographs, aliases, physical description, and international connections will generate information from people who recognize him.
Anyone with information can contact the FBI at 1-800-CALL-FBI. Information may also be provided through an FBI field office or the Bureau’s official online tip system. Individuals outside the United States may contact the nearest U.S. embassy or consulate.
International Search Continues
Canelon Aguirre remains on the FBI’s Ten Most Wanted Fugitives list as authorities continue pursuing the alleged mastermind behind an international ATM jackpotting conspiracy.
The case stands out because it combines several areas of modern federal law enforcement: cybercrime, bank fraud, organized crime, money laundering, and allegations involving material support connected to Tren de Aragua.
His designation as the first cyber fugitive placed on the FBI’s Ten Most Wanted list also marks a significant development in the history of the program. Authorities continue asking anyone with credible information concerning his location, aliases, associates, or activities to contact law enforcement rather than attempting to apprehend him.
The charges against Canelon Aguirre remain allegations unless and until proven in court.
Sources
FBI — Anibal Alexander Canelon Aguirre Wanted Poster
FBI — Ten Most Wanted Fugitives 501 and Beyond
