Tren de Aragua ATM Scheme: Two Sentenced in Omaha

You use an ATM, and the machine looks normal. But somewhere in its software, malware is waiting — installed by a criminal network that stole over $1.5 million from U.S. banks. On June 25, 2026, a federal court in Nebraska sentenced two men at the center of that scheme to six and a half years in federal prison each.

Carlos Javier Padron, 36, a Venezuelan national who unlawfully entered the U.S. in 2021, and Oddry Arnoldo Cabrera Torrealba, 37, pleaded guilty to conspiracy to commit bank burglary and computer fraud. The court also ordered them to jointly pay $1,537,696 in restitution to the banks they targeted. Investigators say both men physically installed a malware variant called Ploutus onto ATMs across the country. Once active, the malware forced ATMs to dispense cash on command — and then deleted itself to avoid detection. Lincoln Police arrested both men at an active jackpotting site in October 2024.

The Tren de Aragua connection

Federal prosecutors say this case goes far beyond two individuals. Following the arrests, investigators identified a network of co-conspirators across the U.S. and abroad. As of the sentencing date, 96 additional defendants had been indicted for related offenses — including material support to a designated foreign terrorist organization. U.S. Attorney for the District of Nebraska Lesley Woods said ATM jackpotting is "TdA's business plan" and their primary source of revenue, funding activities that include human trafficking, armed robbery, and drug distribution. The Justice Department's Criminal Division and Joint Task Force Vulcan — a multi-agency task force originally created to target MS-13 — led the prosecution alongside HSI Omaha and the FBI.

This case is part of the broader Homeland Security Task Force initiative under Executive Order 14159. That order directs federal agencies to prioritize the investigation and removal of violent criminal aliens. HSI Omaha Assistant Special Agent in Charge Elhrick Cerdan said the investigation was designed to "put consumers at ease, knowing their bank's health is sound."

What to do

• If you have any connection — even indirect — to individuals later identified as TdA members, talk to an immigration attorney immediately. Associations with designated terrorist organizations can affect green card applications, naturalization, and asylum cases.
• If you are in removal proceedings and your case involves any criminal charge — even a minor one — ask your attorney how it affects your immigration status before entering any plea.
• If ICE contacts you or someone you know in connection with a criminal investigation, you have the right to remain silent and the right to speak with an attorney before answering questions.
• Monitor official DOJ and HSI announcements if you believe you may be connected to any co-conspirator in this network — 96 additional defendants have been indicted, and the investigation is ongoing.