Five Venezuelans Admit to ATM 'Jackpotting' Plot That Cost US Banks Millions

Key points

• Five Venezuelan nationals pleaded guilty in US federal court to conspiracy to commit bank larceny over ATM jackpotting attacks, where malicious software is used to make cash machines empty themselves.
• The group was arrested in December 2025 after failed attempts on ATMs in Wamego and Manhattan, Kansas, both captured on surveillance cameras.
• Luis Alberto Velasquez-Artigas has already been sentenced to nine months in prison; the other four are awaiting sentencing.
• The FBI says criminals stole over $20 million through ATM jackpotting in the past year, much of it linked to the Venezuelan group Tren de Aragua.
• The Justice Department has now charged 87 alleged Tren de Aragua members in connected cases, with possible sentences of 20 to 335 years.

Five Venezuelan men have pleaded guilty in a US federal court to trying to empty cash machines using malicious software, a technique the industry calls ATM jackpotting.

The defendants are Luis Alberto Velasquez-Artigas, 27, Royder Adrian Figuera-Perez, 29, Javier Mejia Jr, 27, Gabriel Alexjandro Corales-Garcia, 33, and Italo Lizandro Corrales-Carrillo, 26. Each admitted one count of conspiracy to commit bank larceny. Velasquez-Artigas has been sentenced to nine months. The rest are waiting to learn their fate.

The case was first reported by BleepingComputer.

What is ATM jackpotting?

Jackpotting is a physical robbery dressed up as a hack. Criminals open the top part of a cash machine, plug a laptop or USB device into the internal computer, and install malware that tells the machine to dump every note in its cassettes.

Once the software is running, the attacker uses either a plugged-in keyboard or the ATM's own PIN pad to issue the command. The machine then behaves like a slot machine paying out a jackpot, hence the name.

Strains used in past attacks include Ploutus, Alice, GreenDispenser, RIPPER, Skimer, ATMii, ATMitch and SUCEFUL. Ploutus is the one investigators keep finding in the current US wave.

What actually happened in Kansas?

The five men targeted ATMs in Wamego and Manhattan, Kansas, in December 2025. Both attempts failed.

In Wamego, the group could not get the malware onto the machine, and their tampering set off an alarm. Police responded, and the men did not come back. In Manhattan, the ATM refused to dispense cash. Surveillance cameras filmed both attempts, and the five were arrested days later.

"Jackpotting bandits are sweeping the nation," US Attorney Ryan A. Kriegshauser said in the Justice Department's statement. "This particular group's strategy was to specifically target ATMs they thought were by design more vulnerable to malware."

How big is the wider problem?

Big, and growing. The FBI warned in February that criminals stole over $20 million from US cash machines through jackpotting in the past year.

Much of that activity has been traced to Tren de Aragua, a Venezuelan criminal organisation now designated a transnational threat by US authorities. Federal prosecutors have charged 87 alleged members in connected cases. Maximum sentences range from 20 years to 335 years per defendant. In January, two other Venezuelan nationals convicted in South Carolina were ordered to be deported after serving their prison terms.

Should ordinary bank customers worry?

No, not directly. Jackpotting steals cash from the bank, not from customer accounts. Your card details, PIN and balance are not the target: the machine's cash cassettes are.

The risk is indirect. Banks and independent ATM operators absorb the losses, and older machines with weak physical locks or outdated internal software are the ones being hit. If a machine looks tampered with, has an open service panel or exposed wiring, walk away and use another one.