Federal prosecutors in Connecticut charged four Venezuelan nationals on June 29, 2026 with stealing more than $500,000 through an ATM jackpotting scheme, according to the U.S. Attorney's Office for the District of Connecticut. Among those charged is Euclides Moreno Itanare, 28, of Raleigh, North Carolina.

ATM jackpotting — the deployment of malware engineered to force a cash dispenser to eject its entire currency load on command — has drawn repeated federal prosecution in the district. The technique typically requires physical access to the ATM's internals to install the malicious software or "black box" hardware, making it a hybrid of cyberattack and old-fashioned smash-and-grab. Once the malware is active, a confederate positioned at the machine collects the ejected bills, often within minutes.

The Connecticut docket has prior form here. In 2018, the same district prosecuted a parallel jackpotting ring: Argenys Rodriguez, 22, of Springfield, Massachusetts, was sentenced to 12 months and one day by U.S. District Judge Vanessa L. Bryant in Hartford for his role in a scheme that used the same fundamental method. That case established the legal and evidentiary framework the district has since applied to subsequent prosecutions.

The current charges carry weight beyond the dollar figure. Jackpotting operations are rarely the work of lone actors — they require technical capability to source and deploy the malware, logistical coordination across multiple ATM locations, and a distribution network to launder the proceeds. A $500,000 haul spread across four defendants signals an organized crew with defined roles, not opportunistic theft.

The targeting of Venezuelan nationals is a data point worth holding precisely. Federal law enforcement has documented Venezuelan criminal networks operating across a range of financial fraud typologies in the United States over the past several years, but the nationality of defendants does not, on its own, establish organizational affiliation. Prosecutors will need to prove the specific conduct of each individual charged.

The case now moves to the pretrial phase. Whether the defendants will contest the charges or negotiate pleas — as Rodriguez did in the 2018 Connecticut proceeding — will shape how much of the operational detail becomes public. A plea, while closing the criminal case faster, tends to collapse the evidentiary record; a trial would expose the full technical and financial anatomy of the scheme.

For financial institutions and ATM operators, the reappearance of jackpotting prosecutions at this scale is a reminder that endpoint hardening and real-time cash-dispense anomaly detection remain essential controls. The Secret Service and FBI have both issued advisories over the years warning that jackpotting activity tends to cluster geographically and temporally — crews move from region to region before law enforcement can mobilize a coordinated response. A $500,000 theft across what is presumably a short operational window is consistent with that tempo.