Aníbal Alexander Canelón Aguirre, a Venezuelan national known as "The Engineer" and "Prometheus," has been captured in Venezuela after years as a fugitive, according to FBI Director Kash Patel.
Canelón Aguirre is accused of leading an international cybercrime network that targeted ATMs across the United States and allegedly used stolen money to support the Tren de Aragua transnational gang.
Patel announced the arrest during an oversight hearing before the Senate Judiciary Committee. He said the fugitive was located in Venezuela over the weekend and was already being transported to the United States.
"Just this past weekend, we captured a thug down in Venezuela who was on our most wanted list," Patel told lawmakers.
El FBI confirmó la detención en Venezuela de Aníbal Canelón Aguirre, alias “El Ingeniero”, uno de los 10 fugitivos más buscados y presunto líder de una red internacional de jackpotting vinculada al Tren de Aragua #15sep pic.twitter.com/fr0iZeOpjU
— 2001online (@2001OnLine) September 15, 2026
The FBI director did not identify the suspect during the hearing. The bureau later confirmed to Fox News that the person arrested was Canelón Aguirre.
U.S. authorities did not disclosed where in Venezuela the arrest occurred, which agencies participated in the operation or what legal procedure was being used to bring him to the United States.
Canelón Aguirre was placed on the FBI's Ten Most Wanted Fugitives list on March 12, 2026. He became the first person wanted primarily for alleged cybercrimes to be added to the historic list and its 540th fugitive overall.
The FBI had offered a reward of up to $1 million for information leading directly to his arrest.
According to the FBI's case against him, Canelón Aguirre allegedly directed a network that sent teams into different U.S. cities to compromise ATMs through a technique known as "ATM jackpotting."
The scheme involves installing malicious software inside an ATM to force the machine to dispense large quantities of cash without connecting the withdrawal to a legitimate bank account. The stolen money is then moved through an alleged laundering network intended to conceal its origin and destination.
Investigators believe "The Engineer" developed and repeatedly modified the malware used in the attacks, adapting the software to defeat security measures introduced by financial institutions.
Authorities allege that the network had been operating since at least January 2024 and that some of its proceeds were used to support Tren de Aragua. The United States has designated the Venezuelan criminal organization as a foreign terrorist organization, allowing prosecutors to pursue charges involving material support for terrorism.
"We believe Canelon Aguirre is the developer of this malware that's targeted hundreds of financial institutions across our country," Eugene Kowel, special agent in charge of the FBI's Omaha office, said when the fugitive was added to the list.
The FBI has recorded more than 1,800 ATM jackpotting incidents in the United States since 2017, with reported losses exceeding $55 million. The agency has not attributed all those incidents to Canelón Aguirre, but investigators say he was connected to many of the attacks and that the broader operation provided revenue for Tren de Aragua.
A federal arrest warrant was issued for Canelón Aguirre on Dec. 9, 2025, by the U.S. District Court for the District of Nebraska in Omaha.
He faces charges of conspiracy to commit bank fraud, conspiracy to commit bank burglary and intentionally damage protected computer systems, conspiracy to commit money laundering and conspiracy to provide material support to terrorists.
Canelón Aguirre was 49 when he was added to the FBI list. Authorities described him as a Venezuelan citizen with connections to both Venezuela and Mexico who had evaded law enforcement for years.
He is expected to make an initial appearance in federal court after arriving in the United States. The charges against him remain allegations, and he is presumed innocent unless proven guilty.
