The ATM was talking to itself at 3 a.m. in a Lincoln parking lot.

Marta took the call at 3:51 a.m. She was fifty-eight, three years from the pension that her ex-husband had once told her was the only thing keeping her at the bank. She kept her phone face down on the nightstand because the alerts had started waking her dog. The dog was already up.

The voice on the other end was from the operations center in Omaha. The drive-through ATM at the branch off West O Street had emptied itself in eleven minutes. Not a robbery in the way the old-timers meant the word. No mask. No note. No gun. The machine had simply started dispensing cash to nobody in particular and had not stopped until the cassettes were dry.

Marta had seen this before. Twice in the last eighteen months. The first time she had cried in her car in the branch parking lot at six in the morning. The second time she had ordered coffee on the way and made the call to the FBI field office before she got out of the driver's seat. By the third time she had a checklist.

This is a chapter about the third time.

I. THE MACHINE THAT WAS TOLD TO EMPTY ITSELF

Picture an ATM. Not the screen and the keypad. The body. There is a computer inside the cabinet, and there is a safe inside the cabinet, and the computer tells the safe when to push cash out the slot. The computer runs Windows. Most of them still do. The safe is hard to crack. The computer is not.

That is the door.

ATM jackpotting is the name for what happens when someone gets the cabinet open, plugs into the computer, and installs software that tells the safe to dispense without anyone swiping a card. The malware most commonly named in federal filings is called Ploutus. It is named, with the kind of dark humor these things attract, after the Greek god of wealth. Once Ploutus is on the machine, the machine becomes a vending machine. A button gets pressed. The chute starts running. The bills come out in stacks of twenties.

The customer is not the victim. The customer's account is not touched. The bank's cash is what gets walked out the door.

Read that twice. The fraud is invisible to the account holder. There is no statement that arrives wrong. There is no login that shows a zero. The hole opens inside the bank's own reserves, and the only person who has to look at the hole is someone like Marta, at a kitchen counter, at four in the morning, with a dog at her feet.

II. LINCOLN, NEBRASKA, OCTOBER 2024

The Lincoln Police Department arrested two men at the site of a jackpotting incident in October 2024. Their names, per the Department of Justice, are Carlos Javier Padron, then 35, and Oddry Arnoldo Cabrera Torrealba, then 36. Torrealba had also been operating under the name Luis Alejandro Berdugo Barraza. Both were Venezuelan nationals. Both were in the country illegally.

They each pleaded guilty to one count of conspiracy to commit bank burglary and one count of computer fraud and intentional damage to a protected computer. Torrealba was sentenced on June 11, 2026. Padron was sentenced on June 25, 2026. The number on each sentence was the same. Seventy-eight months. Six and a half years.

They were ordered to pay $1,537,696 in joint restitution to the victim banks.

Those are the numbers. Hold them. They will sound small in a minute.

III. THE BUSINESS PLAN

U.S. Attorney Lesley A. Woods used a specific phrase in the announcement of the sentencing. She said ATM jackpotting is the "business plan" of Tren de Aragua. She said it is the organization's "assessed primary source of revenue to fund their terrorist activities." Assistant Attorney General A. Tysen Duva said these crimes "undermine the security of our financial institutions and fuel the operations of violent transnational criminal organizations." The FBI's Eugene Cowel, out of the Omaha field office, called Tren de Aragua a "violent terrorist organization."

Tren de Aragua started as a prison gang in Venezuela in the mid-2000s. It has since spread across the hemisphere. The DOJ's stated position is that proceeds from American jackpotting are split, with roughly half routed back to TdA leadership in Venezuela. That is the government's assessment. It has been repeated across multiple indictments.

Padron and Torrealba are not the whole story. They are two names on a long list. As of January 26, 2026, federal prosecutors had charged 87 individuals in the broader ATM conspiracy. By February 20, 2026, the count of charged TdA members and leaders had reached 93. Between 2021 and 2025, law enforcement has tied more than 1,900 jackpotting incidents and over $51 million in losses to the same family of operations. In 2025 alone there were more than 700 confirmed cases and over $20 million stolen.

A six-hundred-percent increase between 2021 and 2025.

By November 2025, jackpotting and cash-out attacks accounted for 72 percent of all reported ATM crime. The men with the crowbars and the masks have been replaced by the men with the USB sticks.

IV. WHAT MARTA SAW WHEN SHE GOT TO THE BRANCH

The cabinet was closed when she pulled in. From the outside, the machine looked like a machine. The chute was empty because the cassettes were empty. The screen was on its idle loop. A Ford F-150 was parked too close to the bollards, and the cameras had caught a man in a black hoodie standing at the side of the ATM for about nineteen minutes. The cameras had not caught his face.

She unlocked the back of the unit with her bank's master key. The interior looked the way these interiors always look afterward. The computer inside had a small device plugged into one of the USB ports. Not large. The size of a stick of gum. The lid of the cabinet had been opened with what looked like a key, not a pry bar. The men who do this work tend to have access to ATM master keys. The keys are sold online. The keys are mailed across borders. The keys are part of the kit.

She did not touch anything. She called the FBI and then she called her boss and then she called her son, who lived in Denver, because she needed to hear a voice that was not on a checklist.

She was not ruined. Her account was fine. Her pension was fine. The bank would absorb the loss and report it in the quarterly. Marta was not the kind of victim a true crime book is usually about.

But she is the person at the door of the machine. She is the one who keeps explaining to the board why the same hole keeps opening. She is the one who has stopped sleeping through Tuesdays. The cost is not in her checking account. The cost is in the look on her face during the 9 a.m. call when her regional director asks, again, what they are going to do about it.

V. THE OTHER NAMES

On the same day Torrealba was sentenced, two other men, Darrin Moises Daza-Segura and Winder Alexander Canelon-Tiapa, were sentenced to ten months in prison for jackpotting in Mississippi, ordered to pay $47,250 in restitution, and slated for deportation. In December 2025, OFAC sanctioned a woman named Jimena Romina Araya Navarro, identified as an alleged TdA leader, and charged her with providing material support to TdA through jackpotting. The leader of Tren de Aragua, Hector Rusthenford Guerrero Flores, known as Niño Guerrero, died in June 2026.

The press releases pile up. The mug shots pile up. The deportation orders pile up. The malware keeps spreading.

That is the shape of the problem. The arrests are real. The convictions are real. The men named in this chapter will serve six and a half years in federal custody and then be removed from the country. None of that closes the door on the back of the cabinet.

The door is the design of the cabinet.

VI. WHAT THE MACHINE LOOKS LIKE WHEN YOU NAME IT

This is not a man stealing from a bank. This is a system. The malware is a product. The keys are a supply chain. The men who stand at the ATM in the parking lot are the lowest-paid workers in a layered organization that, according to the DOJ, routes money back to a prison gang in Venezuela. The men in the parking lot are interchangeable. The ATMs are interchangeable. The cash is the only thing the machine cares about.

When the DOJ says "business plan," they are not being clever. They are describing a revenue model. The model has a product (Ploutus), a delivery mechanism (physical access to the cabinet), a labor force (men willing to stand in parking lots at 3 a.m. in October), a distribution channel (cash, walked out the door, laundered up the chain), and a customer (the organization that consumes the profits).

The customer is in Caracas. The labor was in Lincoln. The product was on a USB stick. The bill, eventually, lands on Marta's desk.

VII. THE CHAIR AT 4 A.M.

Marta drove home that morning at seven. The branch had been processed. The FBI had taken the device. The cabinet had been resealed. The cassettes would be refilled by the armored truck on Monday. The customers who used the ATM that weekend would never know the machine had spent eleven minutes in October emptying itself for a stranger.

She sat at her kitchen table with the dog at her feet and a coffee she did not drink. She is sixty in November. Two years from the pension. She has done this work for thirty-one years. She has watched the threat shift from men with shotguns to men with bolt cutters to men with software, and she has watched the response stay roughly the same. A press release. A sentencing. A restitution number that does not cover the loss. A new advisory from the FBI about layered security and machine-specific keys and encrypted hard drives.

She has read the advisories. She has implemented the advisories. The machines still empty themselves.

That is the chapter. Two men in a parking lot in Nebraska went to prison for 78 months each. The DOJ said the right things and put the right names in the right press release. A prison gang in Venezuela continued to be the assessed customer of the world's largest American ATM cash-out operation. A regional bank operations manager in Lincoln went back to bed at eight and slept for two hours.

The machine was told to empty itself.

It will be told again.