Venezuelan Juan Manuel Gouveia-Aguilera was sentenced to eight years in federal prison for being part of a network that infected ATMs with malware to force them to dispense cash. The U.S. Department of Justice claims that the ATM jackpotting conspiracy, linked through direct and indirect connections to the Tren de Aragua, resulted in attacks across 47 states, the District of Columbia, and several countries.
Federal Judge Brian C. Buescher sentenced Gouveia-Aguilera, 27, to 96 months in prison, five years of supervised release, and $500 in special assessments. He also ordered restitution payment, although the official release does not disclose the exact amount.
The court found that Gouveia-Aguilera was responsible for losses exceeding $3.5 million. However, this figure does not necessarily imply that he personally withdrew all the money. In a federal conspiracy, the amount attributed during sentencing can include losses directly caused by the accused and foreseeable operations carried out by other participants.
Who is Juan Manuel Gouveia-Aguilera?
Juan Manuel Gouveia-Aguilera is a Venezuelan citizen convicted for participating in a conspiracy involving bank fraud, bank robbery, and cyberattacks against ATMs in the United States.
The sentencing took place on August 20, 2026, in the U.S. District Court for the District of Nebraska. The Federal Prosecutor’s Office of Nebraska announced that this is the most extensive federal sentence known for an individual’s involvement in jackpotting operations.
Gouveia-Aguilera pleaded guilty to conspiracy to commit bank fraud, conspiracy to commit bank robbery, computer fraud, bank fraud, and bank robbery.
His guilty plea distinguishes his situation from that of other defendants who still retain the presumption of innocence and have the right to demand that the prosecution proves the charges.
Did he personally steal $3.5 million?
The court held Gouveia-Aguilera accountable for losses exceeding $3.5 million. However, the Department of Justice did not claim that the Venezuelan had personally withdrawn that amount.
This distinction is legally significant. Federal sentencing rules allow attributing to a member of a conspiracy the losses directly caused by him and those arising from joint criminal activities that were reasonably foreseeable.
For that reason, the correct headline should state that he was found responsible for losses exceeding $3.5 million, not that he individually stole all that money.
A report by Venezuela Política published in October 2025 documented specific operations attributed to Gouveia-Aguilera and Alfredo Pinto-Mendoza in Washington, Oregon, and Colorado.
The documents linked both defendants to withdrawals of $93,480 and $60,640 in Walla Walla, Washington; $43,920 in Milton-Freewater, Oregon; and $8,000 in Wellington, Colorado. The identified transactions totaled approximately $206,040.
The difference between that amount and the $3.5 million established in the sentencing suggests that the judge considered a larger universe of losses related to the conspiracy. The final calculation should be available in the presentential report, the guilty plea agreement, and the transcript of the sentencing hearing.
What is ATM jackpotting?
ATM jackpotting is a form of cybercrime where criminals manipulate an ATM’s computer system to force it to dispense cash without recording a legitimate bank transaction.
Unlike card cloning fraud, jackpotting directly attacks the ATM’s hardware and software. Operators can physically open the machines, remove the hard drive, install modified components, or run malicious programs that can control cash dispensing.
Federal investigations identified the use of Ploutus, a family of malware designed to compromise ATMs. Once installed, the software allows instructions to be sent to the machine to release the stored cash.
The financial institution suffers a loss because the cash is dispensed without generating a debit against a customer’s account.
How the jackpotting network operated
According to prosecutors, the organization would select banks and credit unions, identify vulnerable ATMs, and send operators to physically manipulate the machines. Other participants would develop or acquire the malware, recruit operatives, coordinate travel, and distribute the cash.
The conspiracy is alleged to have used Ploutus years before the operations investigated in Nebraska. The attacks spread over dozens of states and primarily targeted regional financial institutions.
In some operations, the responsible parties used keys to open the ATM, removed the hard drive, and installed a device equipped with malware. They then executed instructions for the machine to dispense large amounts of cash.
The structure illustrates the convergence of cybercrime and traditional organized crime. The attacks required technical knowledge, physical access to ATMs, vehicles, interstate coordination, and mechanisms to move the cash.
The attacks attributed to Gouveia-Aguilera
The initial indictment stated that Gouveia-Aguilera and Pinto-Mendoza participated in the conspiracy between March 1 and May 1, 2025. Prosecutors linked them to operations in Nebraska, Washington, Oregon, and Colorado.
On April 27, 2025, both allegedly went to an ATM at Union Pacific Employees Federal Credit Union in North Platte, Nebraska. According to court documents, they removed the ATM’s hard drive and installed another device containing malware.
They were also linked to attacks on ATMs of Baker Boyer Bank in Walla Walla, Washington, and Milton-Freewater, Oregon. The operations described in the file allowed for nearly $200,000 to be withdrawn from those two locations.
The subsequent guilty plea of Gouveia-Aguilera covered five charges and linked him to the national investigation conducted by the Nebraska prosecutor’s office.
The crimes he was convicted of
Gouveia-Aguilera was convicted after pleading guilty to five federal crimes related to bank fraud, bank robbery, and illegal access to computer systems.
The conspiracy to commit bank fraud is prosecuted under section 1349 of Title 18 of the United States Code. Bank fraud is covered under section 1344, while conspiracies to commit crimes against the United States are regulated by section 371.
Crimes of illegal access to protected computers are prosecuted under section 1030. Charges related to theft or unlawful entry against banking facilities may fall under section 2113.
The 96-month sentence reflects the joint assessment of losses, the scope of the conspiracy, the defendant’s involvement, and other factors established in federal sentencing guidelines.
A network with 119 defendants in Nebraska
The Department of Justice reported that 119 individuals have been charged in the District of Nebraska for their alleged participation in the conspiracy. This number does not mean that they all appear in a single case or that they played the same roles.
The investigation includes various allegations, cases, and related processes. Some defendants may have physically installed the malware, while others allegedly participated in recruitment, logistical coordination, ATM selection, or cash distribution.
Gouveia-Aguilera is the third defendant sentenced in Nebraska within this operation. Oddry Arnoldo Cabrera Torrealba and Carlos Javier Padrón previously received sentences of 78 months each.
Other defendants maintain the presumption of innocence until proven guilty or until the prosecution demonstrates the charges beyond a reasonable doubt.
Attacks across 47 states and several countries
The investigation determined that the conspiracy attacked or attempted to intervene in ATMs across 47 states, the District of Columbia, and several countries.
Venezuela Política documented operations in Nebraska, Utah, Kansas, Washington, Iowa, Oklahoma, Tennessee, Missouri, New York, Oregon, Colorado, and Michigan. The targets included regional banks and credit unions.
The scale of the operation necessitated coordinating FBI offices in Omaha, Denver, Houston, Miami, New Orleans, Oklahoma, Sacramento, Seattle, and Springfield. National Security Investigations, the Secret Service, the U.S. Marshal Service, and state and local law enforcement also participated.
The prosecution is supported by the Computer Crimes and Intellectual Property Section of the Justice Department and the Joint Task Force Vulcan.
The link to the Tren de Aragua
The Department of Justice, the FBI, and National Security Investigations assert that the conspiracy maintains direct and indirect ties to the Tren de Aragua.
U.S. authorities claim that this organization incorporated financial fraud and jackpotting attacks as sources of income. The money obtained is said to have funded criminal operations.
However, public information does not detail Gouveia-Aguilera’s personal connection to the leaders of the Tren de Aragua. It also does not specify how much, if any, was directly transferred to the organization.
The guilty plea demonstrates his responsibility for the accepted bank and computer crimes. To determine if he was a formal member of the Tren de Aragua, what role he played, or if he received direct orders from their leaders, one would need to review the guilty plea agreement, the statement of facts, and the presentential report.
U.S. designates Tren de Aragua as a terrorist organization
The Department of State designated the Tren de Aragua as a Foreign Terrorist Organization and Specially Designated Global Terrorist on February 20, 2025.
The decision was officially published in the Federal Register and the organization remains on the State Department’s list.
This designation allows the application of tools related to asset freezing, financial sanctions, material support to terrorism, and investigation of individuals knowingly collaborating with the organization.
According to available official information, Gouveia-Aguilera was not convicted of providing material support to a terrorist organization. His crimes pertain to bank fraud, bank robbery, conspiracy, and illegal access to computers.
Therefore, the connection to the Tren de Aragua must be presented as a conclusion of the federal investigation into the wider network, without replacing the specific crimes established in his sentencing.
The longest federal sentence for jackpotting
The eight-year sentence exceeds the 78-month sentences previously imposed on Cabrera Torrealba and Padrón. The Department of Justice considers this to be the longest known federal sentence for an individual’s involvement in jackpotting operations.
The sentence also includes five years of supervised release. This period will begin after Gouveia-Aguilera is released from prison and will be subject to conditions imposed by the court.
The judge ordered restitution payment, but the public announcement does not identify the amount. It also does not reveal the full calculation of the federal guidelines, the criminal history considered, or the adjustments applied.
What remains to be known from the case file
The sentence confirms that Gouveia-Aguilera accepted criminal responsibility, received 96 months in prison, and was held accountable for losses exceeding $3.5 million.
The definitive amount of restitution, the statement of facts accepted by the defendant, the presentential report, and the transcript of the August 20, 2026 hearing still need to be disclosed.
These documents would clarify how much money was directly withdrawn by Gouveia-Aguilera, what losses attributed to other participants were assigned to him, and what evidence supports his individual connection to the broader criminal structure.
The conviction demonstrates that the U.S. is investigating jackpotting as a transnational organized crime activity and not merely as a series of isolated robberies against ATMs.
The court held Gouveia-Aguilera responsible for losses exceeding $3.5 million, but the announcement does not state that he personally withdrew all that amount. Documents reviewed by Venezuela Política identified approximately $206,040 in operations directly linked to him and Pinto-Mendoza.
The government claims that the conspiracy is connected to the Tren de Aragua, and that their attacks reached 47 states, Washington D.C., and several countries. However, personal attribution of membership, rank, or direct funding requires additional judicial documentation.