Tren de Aragua on Tron: $6.08M passed through seven sanctioned wallets — every dollar went on to Binance

On 30 September 2026 OFAC, the Treasury’s sanctions office, designated ten targets in what it called a financial network of Tren de Aragua. The Treasury ties the network to ATM “jackpotting” — forcing cash machines to dispense their contents — and cites federal figures of more than $40 million in reported losses across more than 1,500 incidents. It says the proceeds were laundered through cryptocurrency and sent back to the gang’s leadership.

Seven of the designated people each have one Tron address in their entry. Tether blacklisted all seven the same day, between 16:14:03 and 16:14:24 UTC. Who the addresses belong to is OFAC’s statement, not ours; the names are in its list and we do not repeat them. Below is what the seven addresses did on chain. For each of them the USDT received minus the USDT sent equals the balance, so the count is complete.

Together the seven received 6,079,121 USDT in 1,456 transfers from 93 senders. They sent out 6,079,101 USDT. The remaining 20 USDT is what was frozen.

Everything that left went to exactly two addresses, and our database labels both as Binance’s own wallets. 5.75 million USDT went to one of them, TDqSquXBgUCLYvYC4XZgrprLK589dkhSCf, and 0.33 million to the other. All seven wallets used the first; five also used the second. There is no third destination — no other exchange, no bridge, no private wallet.

The seven never sent a single transfer to one another. Each worked as its own pipe into the same place.

The busiest wallet, TCUmMCHQEbFFdGvfdg2LeS64QfzUKP2AgW, handled 2.12 million. Its pattern is the clearest. On 16 April 2025 at 18:12 UTC it received 699,710 USDT; at 18:16 it sent 699,720 to Binance. On 26 June 2025 it received 477,446 at 17:25 and sent 477,456 at 17:26. On 11 September it received 274,390 and passed on 274,400 five minutes later.

Nothing was held, split or mixed. This is how an exchange deposit address behaves: a customer is given an address, money arrives, and the exchange sweeps it into its main wallets within minutes. An address that only ever pays the exchange’s own wallets, always in full and always at once, is in all likelihood not a wallet somebody holds keys to but a deposit address of an account at that exchange. We cannot see inside Binance, so we state this as what the pattern shows, not as a confirmed fact.

The three large lots above, 1.59 million in total, came from one address, TFXALFyHvTv8h7L6A1w8bjG7K4XSdoKzdM. It is not a personal wallet: in eleven months it took in 105.9 million USDT from 172 addresses and paid it out to 230. That is the profile of a trading desk or broker, and the payments to the listed wallet are 1.5% of its turnover.

More telling are three smaller wallets that are not on the sanctions list. Between them they sent 2.09 million USDT — 34% of everything the seven received — and they sent it to five of the seven. They also passed money back and forth among themselves, and part of what they held had come out of exchange withdrawal wallets. All three are empty today.

About 165,000 USDT reached the seven straight from exchange withdrawal wallets — KuCoin, Binance, Bitget, Bybit, Bitso, OKX and others — and about 900,000 from deposit addresses of an unnamed service.

The flow was small at first: 68,000 USDT in 2022, 316,000 in 2023, 1.29 million in 2024. Then 4.39 million in 2025, with peaks in April, June and September. In December 2025 the Treasury took an earlier action against a Tren de Aragua money-laundering network. From January 2026 the seven wallets received 13,600 USDT in total. The last payment of any size left on 4 May 2026.

So when the seven addresses were listed on 30 September 2026, there was nothing on them to freeze. This is the same picture we found on the seven Hamas-linked wallets sanctioned in July: the listing arrived after the wallets had done their work.

If these are deposit addresses, two things follow. First, Tether’s blacklist of the seven addresses stops very little: the money was never kept there, and the 20 USDT that was frozen is change. What matters is the accounts behind the addresses, and only the exchange can freeze those. Second, the trail does not end in a dead end. Every one of the 859 outgoing transfers credited an account, and accounts at a large exchange have identity records behind them. That does not mean the exchange did anything wrong; it means the people who can say whose accounts received 6.08 million USDT are the exchange and the authorities, not an outside reader of the chain.

In our database the seven addresses carry the sanctions label from OFAC’s list, and addresses that sent them money show that link as their risk. We did not mark the exchange’s wallets or the large desk, which serve many unrelated customers. You can check any address on the address check page.

It does not say who owns any wallet beyond repeating OFAC’s attribution, and it names no person. It does not say the senders knew whom they were paying. It does not say the 6.08 million is the proceeds of the ATM thefts or all of them — only that this is what passed through the seven listed addresses in USDT on Tron. “Binance” refers to wallets labelled as the exchange’s own in our database.