Two Venezuelans have been indicted by a grand jury in the U.S. District Court for the Eastern District of California for ATM robbery, facing multiple charges that could result in sentences of up to ten years in prison and hefty fines.
Between April 28 and May 29, 2025, they allegedly took USD 212,800, according to reported incidents. However, the document mentions at least nine unquantified attacks that could increase the cited amount.
The individuals involved are Joel Alejandro Morantes Leal, a 25-year-old resident of San Cristóbal, and Endis Daniel González Ortega, age 22, who were charged with conspiracy to steal cash from ATMs in Merced and Tulare counties, as well as in six other western U.S. states, according to information provided by the prosecution.
Morantes Leal is also facing five additional charges, including one for bank robbery and another for unauthorized access to a protected computer for fraudulent activities, along with three counts of attempting to access a protected computer for fraud.
If convicted of conspiracy, Joel Alejandro Morantes Leal and Endis Daniel González Ortega could face up to 5 years in prison and pay a fine of USD 250,000. The maximum penalty for bank robbery is 10 years and a USD 250,000 fine. The charges of accessing or attempting to access a protected computer for committing fraud carry a maximum sentence of 5 years and a fine of USD 250,000 for each charge.
Affidavit for Arrest Warrant
On June 25, 2025, Agent Mauro (“Adrián”) Ramírez-Cazares submitted an affidavit to the U.S. District Court for the Eastern District of California to support a criminal complaint against Endis Daniel González Ortega, accused of Conspiracy Against the United States (bank robbery, in violation of 18 U.S.C. 2113(b)).
The law enforcement officer stated that González Ortega engaged in criminal activity between April 27 and May 29, 2025, in Merced and Tulare counties, as well as in other locations within the Eastern District of California.
Ramírez-Cazares’s affidavit requests an arrest warrant for Endis Daniel González Ortega for conspiracy to commit bank robbery. Before the court, he detailed a series of “jackpotting” incidents— a type of crime exploiting vulnerabilities in the software, hardware, and physical structure of an ATM to dispense cash in unauthorized transactions—allegedly committed by the defendant.
Criminals manipulated ATMs in California, Oregon, Washington, Colorado, and Nebraska between April and May 2025, according to investigations by the FBI and other agencies, which identified Joel Alejandro Morantes Leal as the primary perpetrator through surveillance. Meanwhile, González Ortega was arrested along with Morantes Leal in Colorado. Evidence from his phone and statements confirm his involvement in the conspiracy.
The “Jackpotting” Investigation
The FBI’s investigation led to the identification and arrest of Joel Alejandro Morantes Leal and Endis Daniel González Ortega, believed to be part of a broader conspiracy.
Endis Daniel González Ortega was implicated in incidents in Colorado and Nebraska.
It was determined that there was a pattern of coordinated operations involving multiple individuals and vehicles engaged in surveillance, execution of attacks, and transportation. Communications via WhatsApp group chats displayed planning, execution, and discussions about procedures and profit distribution.
Joel Alejandro Morantes Leal faces five charges.
Morantes Leal and González Ortega exploited vulnerabilities in ATM software, hardware, and physical structures to dispense cash in unauthorized transactions. They used generic keys to access the ATM interiors, extracted hard drives to load malware, and manipulated systems with a wireless keyboard and a cellphone.
The Accused
Authorities identified Joel Alejandro Morantes Leal as the main perpetrator of many attacks, recognized by his physical appearance, distinctive tattoos, and footwear. Endis Daniel González Ortega was identified as an active accomplice involved in planning and execution, especially in the most recent incidents in Colorado and Nebraska.
Joel Alejandro Morantes Leal is the primary perpetrator of the attacks.
These men used multiple vehicles and changed plates or used paper plates to evade detection. License Plate Reader analysis was crucial in linking vehicles to each other and the suspects.
The conspiracy was not limited to a single area, extending across Eastern California, Oregon, Washington, Colorado, and Nebraska, indicating a well-organized and mobile criminal network.
The Incidents in California and Losses
Investigations determined that:
- On April 28, 2025, Atwater, California: A black Toyota Prius (CA 9NUS045) conducted surveillance, followed by a gray Toyota Prius (with paper plate from Washington A7226652) containing Morantes, who attempted to manipulate the ATM with a wireless keyboard and a cellphone but failed due to “operating system issues.”
- On April 28, 2025, Merced, California: The same black Prius and gray Prius were involved. Morantes tried to access the ATM, but could not open it.
- On April 28, 2025, Los Baños, California: Morantes successfully executed “jackpotting,” obtaining USD 94,800. Surveillance footage shows him with another individual collecting the cash.
- On May 7 and 8, 2025, Visalia and Tulare, California: A silver Honda Odyssey was used. Morantes was observed opening the ATM and stealing the computer hard drive in at least one incident.
- Vehicle Linkage Through LPR: License Plate Reader analysis showed that the gray Prius (real plate CA 9SNY253) traveled with the black Prius (9NUS045) and later with the silver Honda Odyssey (CA 5XPA999), establishing a travel pattern among the vehicles and incidents.
- Incidents extending to other states: The group is believed to be responsible for at least “nine other jackpotting incidents outside California,” in Oregon and Washington, using similar tactics and techniques.
Endis Daniel González’s Involvement
Endis Daniel González Ortega was implicated in incidents in Colorado and Nebraska at the end of May 2025.
- These incidents include a successful “jackpotting” of USD 68,000 in Cañon City, Colorado (May 23, 2025) with Morantes, and attacks in Greeley, Colorado (May 27, 2025, USD 10,000 stolen), Fort Collins, Colorado (May 28, 2025), and Wellington, Colorado (May 28, 2025, USD 8,000 stolen), all of which involved Morantes and the silver Mazda.
- González and Morantes were seen together during a successful “jackpotting” of USD 32,000 in Sidney, Nebraska (May 29, 2025), where González was seen as the driver and Morantes as a passenger.
- Both González and Morantes were arrested on May 29, 2025, in Aurora, Colorado, after surveillance teams located and stopped the gray Toyota Corolla they were trying to load.
- González confirmed it was his vehicle and that he was driving during the Sidney incident, admitting he was driving while Morantes was “taking the money.”
- Endis Daniel González Ortega also attempted to negotiate his release, offering to hand over the cash: “I want to get out of here, I honestly know where the money is and can give it to you right now if you take me. The money is in the car… in the Toyota Corolla, in the trunk.”
Seized Evidence
Authorities collected evidence incriminating the accused:
- From the Toyota Corolla: a bundle of U.S. dollar bills tied with a rubber band and multiple stacks of U.S. dollar bills also tied with rubber bands.
- From the Mazda: a laptop, two computer keyboards, and a box of Apple earbuds.
- From González’s cellphone: a video taken on the night of May 28, 2025, near the Points West Community Bank (PWCB) in Wellington, Colorado, consistent with someone surveilling the area.
- WhatsApp Chats: several group chats on WhatsApp where planning, executing, and operations for “jackpotting” incidents were discussed. González was an active participant in these chats, where Morantes led discussions about profit distribution.
- Conspiracy Evidence: The evidence, including facial recognition, tattoos, footwear, travel patterns of vehicles, WhatsApp conversations, and the partial confession of Endis Daniel González Ortega, establish probable cause to believe he conspired with Joel Alejandro Morantes Leal and others to commit bank robbery and a conspiracy charge for bank robbery (18 U.S.C. § 371 and § 2113(b)).
Watch on Sin Filtros “Maduro’s Drones, Weapons for Ukraine, and the Autopen Scandal”: