Colombia grants extradition of Bastardo Torrealba for jackpotting network

The national Government granted the extradition of Venezuelan citizen Daniel Eduardo Bastardo Torrealba to the United States of America to appear at trial on four charges linked to a “jackpotting” network that emptied ATMs using malware. The decision is contained in Executive Resolution number 451 of 2026, signed on October 5, 2026, by the President of the Republic, Abelardo de la Espriella, and by the Minister of Justice and Law, Iván Alfonso Cancino González, and published in Official Gazette number 53,652 on Thursday, October 8, 2026.

The request arrived via diplomatic channels: through Note Verbale number 2588 dated December 19, 2025, the Government of the United States of America, through its Embassy in Colombia, requested the provisional detention for extradition purposes of Bastardo Torrealba. The requested party had been detained on December 18, 2025, by the Special Interagency Investigation Group of the Criminal Investigation Directorate and Interpol of the National Police, based on an Interpol red notice, and the Attorney General of the Nation decreed his arrest via resolution on December 23, 2025.

The request was formalized with Note Verbale number 0180 on February 10, 2026. The citizen is the subject of the Indictment in Case number 8:25CR242 (also referred to as 8:25-cr-00242-BCB-RCC), issued on December 9, 2025, in the United States District Court for the District of Nebraska. The Criminal Cassation Chamber of the Supreme Court of Justice, through a ruling on September 2, 2026, issued a favorable opinion on the extradition, and the Government, based on article 501 of Law 906 of 2004, resolved to grant it.

The four imputed charges

The handover is authorized so that Bastardo Torrealba may appear before U.S. authorities for:

• Charge One: conspiracy to commit bank fraud.
• Charge Two: conspiracy to commit forced theft, bank fraud, and computer-related activities.
• Charge Three: conspiracy to commit money laundering.
• Charge Four: conspiracy to provide material support to terrorists.

The “jackpotting” modus operandi

According to the accusation transcribed in the resolution, the ATM malware was implemented in three stages. First, the members of the conspiracy obtained physical access to the ATM, extracted the data storage device—hard drive or solid-state drive—installed the malicious code, and reinserted it. Then, they remotely activated the malware using special codes or commands, bypassing security systems and taking control of the operations. Finally, they sent a dispensing command that emptied the cash until it was exhausted or the process was interrupted.

The group operated with defined roles: some traveled in advance to photograph the ATM and its internal hardware and verify that there was no silent alarm; others installed the malware, and others collected the money. The program included an executable file that triggered its self-destruction after the mass extraction of cash to avoid detection during a forensic analysis.

Figures and transnational scope

Between February 2024 and December 2025, the defendants committed or attempted to commit at least 63 “jackpotting” attacks on ATMs of the victim banks and at least 54 on those of the victim credit unions. The total loss for the financial institutions was at least 5,401,181 dollars, and an attempt was made to obtain at least an additional 1,429,738 dollars.

• On October 6, 2024, in Nebraska City, Nebraska, an attack produced approximately 19,000 dollars in illicit gains.
• On October 26, 2024, in Lincoln, Nebraska, an attempt was made to obtain nearly 199,466 dollars.
• On August 16 and 17, 2025, two ATMs of victim credit union-2, in Kearney, Nebraska, reported losses of approximately 300,000 dollars.
• Losses per attack occasionally exceeded 100,000 dollars.

The conducts were planned from the District of Nebraska and from Venezuela, Colombia, Mexico, Spain, El Salvador, and Honduras. The accusation also mentions Aníbal Alexander Canelón Aguirre, alias “Prometheus” and “El Ingeniero”, among the members of the conspiracy.

Conditions of delivery

Executive Resolution number 451 of 2026 orders the delivery under the commitment of the requesting State to comply with the conditions of article 494 of Law 906 of 2004: the extradited person shall not be subjected to forced disappearance, torture, or cruel, inhuman, or degrading treatment or punishment, nor to banishment, life imprisonment, or confiscation. It also warns that they may not be tried for a crime other than that which motivated the extradition nor sanctioned in a manner different from the imposed sentence.

The administrative act provides for the personal notification of the decision to the interested party or their proxy, who may file an appeal for reversal within ten (10) days following the notification, and orders that a copy be sent to the Directorate of International Legal Affairs of the Ministry of Foreign Affairs and to the Attorney General of the Nation. The resolution takes effect as of the date of its finality.

The case illustrates how financial cybercrime operates today as a transnational network: a single “jackpotting” scheme with ramifications in seven countries and losses exceeding 5.4 million dollars ends up being defined in an extradition administrative act published in the Official Gazette. For readers, the resolution confirms that Colombia maintains active judicial cooperation with the United States and that computer crimes against the financial system are covered by current extradition treaties.

Source: Official Gazette, number 53,652 of October 8, 2026, section I, p. 6 (official reference: Executive Resolution number 451 of 2026).