Sanctioned TRON Addresses: The USDT Trail Goes Back to 2022

On September 30, the US Treasury added seven TRON addresses to its sanctions list. They aren't mixer addresses or exchange hot wallets. They're plain deposit addresses at a major crypto exchange, the kind you get when you press "deposit USDT" in your own account.

The people behind them weren't crypto natives either. They're accused of robbing cash machines.

The ATM crew that cashed out in USDT

Tren de Aragua is a Venezuelan gang that the US listed as a foreign terrorist organisation in February 2025. One of its revenue lines is ATM jackpotting. A team photographs a cash machine and checks it for silent alarms. A second team breaks it open, pulls the hard drive, loads malware onto it and puts it back. A third team collects the cash when the machine is told to empty itself without debiting anyone's account. The malware, a strain of Ploutus, wipes itself afterwards.

Treasury's count: $40.73 million taken from US banks across more than 1,500 attacks, as of August 2025. Prosecutors have indicted 98 people since October 2025. The alleged author of the malware, Anibal Alexander Canelon Aguirre, who goes by "Prometheus", was on the FBI's Ten Most Wanted list until his capture. He appeared in a Nebraska court on October 2.

Stacks of banknotes are hard to move across borders. USDT on TRON is easy. So the crew converted cash into stablecoins and parked them at exchange deposit addresses, seven in all, each tied to a named member. On September 30, OFAC designated the people, two Mexico-registered companies, and those seven addresses under Executive Orders 13224 and 13581.

What the addresses show

Blockchain analytics firms had the addresses mapped within hours. The figures from Scorechain and TRM Labs:

• About $6.1 million passed through the seven addresses in roughly 3,900 transactions.
• Almost all of it was USDT on TRON.
• The first transaction dates to March 2022. The last to July 2026.
• Five of the seven addresses went quiet during 2025.
• The combined balance left on them is under $40.

Read that last line again. There was nothing to freeze. Chainalysis notes that Tether had already frozen USDT on several wallets with exposure to these addresses, but the designated addresses themselves were empty by the time the listing came out. What the designation changed was the status of four years of transaction history.

That's the part that matters to anyone who has ever received USDT on TRON.

Sanctions work backwards

A freeze is a switch somebody flips today. A designation is a label that applies to everything the address ever touched. The seven addresses were not clean on September 29 and dirty on September 30. As far as every compliance screen in the world is concerned, they have been dirty since March 2022. The screens simply didn't know yet.

Now they do. Exchanges and payment processors re-run their customers against the updated SDN list. Deposits that cleared in 2023 get a second look. An address that sent USDT to one of the seven, or received USDT from a wallet that did, picks up a flag it didn't carry last week.

This is why TRM Labs told its clients to "review historical exposure" and to extend screening to indirect exposure one or two hops out. Scorechain was blunter: run a full-history review from March 2022 to July 2026, not the recent months only.

Those notes were written for exchanges. The exchange isn't the one who gets hurt, though. If your deposit at a European exchange is held because an address two hops back in its history just landed on the SDN list, the exchange files a report and moves on. You're the one explaining a 2023 payment from a client you barely remember.

Why this lands on TRON

OFAC named TRON addresses because that's where the money was. More USDT moves on TRON than on any other chain. It's cheap and fast, and it's the default rail for P2P trading and freelance payments across Latin America, Africa and parts of Asia. Those same properties make it the default rail for cashing out criminal proceeds.

It's also the network most people in Europe mean when they say "pay me in USDT". If you invoice clients in USDT-TRC20, your wallet sits on the same chain as the crew's, and your counterparties use the same P2P desks and the same exchanges. Whether you did anything wrong is beside the point. What counts is whether any of the money that reached you passed through the same hands.

Tether's own numbers show how much screening already happens at the issuer level. On September 28, two days before this designation, it said it had helped freeze about $550 million of USDT linked to Iran in 2026 alone. Issuer freezes follow designations. Exchange reviews follow designations. Your wallet's history is what gets reviewed.

What to do this week

You can't un-receive a payment from 2023. You can know what your history looks like before someone else looks at it for you.

• Screen your own receiving addresses, not only your payers. If you've been paid in USDT on TRON for a few years, run every address you've used and read the sanctions and indirect-exposure findings.
• Repeat it after major SDN updates. Last month's clean result was computed against last month's list, and OFAC adds crypto addresses most months.
• Keep the report. A dated screening result from before a deposit is held is worth more than any explanation written afterwards.

If you don't know where to start, you can check a TRON or Ethereum address and get a sanctions, mixer and exposure result in under a minute. Run your own wallet first.

Those seven addresses took in $6.1 million over four years at a major exchange, and every deposit went through, because until September 30 there was nothing on any list to match them against. Sanctions don't tell you what was wrong yesterday. They tell you what was wrong all along.