ATM jackpot crew targets local banks

GREYBULL — A group of thieves with advanced technological capabilities targeted several ATMs in the Big Horn Basin early last week during a 36-hour crime spree that stretched from Montana to Colorado.

Two members of the group were arrested in the Denver area within 24 hours of the thefts, but the others remain at large as federal agencies continue their investigation, according to Big Horn County Sheriff Ken Blackburn.

Authorities suspect that at least nine banks were hit, including five in Montana and four in Wyoming. Among them were the Big Horn Federal branches in Lovell, Greybull and Thermopolis; the identity of the fourth Wyoming bank was not disclosed.

The jackpotting of ATMs, which is increasing across the nation, is described as the exploitation of the physical and software vulnerabilities in ATMs that causes them to begin dispensing cash. According to law enforcement, the thieves gain access to the inside of an ATM and install a device that allows a hacker to assume control of the machine. Soon after, others arrive to take the cash, which is untethered to any specific bank account.

John Coyne III, president and CEO of Big Horn Federal, said the ATM thefts at its three locations occurred Sunday, March 16. In Lovell, the operation started around 9 a.m.; in Greybull, around 2 p.m., and in Thermopolis, around 7 p.m.

The thieves had begun their spree on the evening of Saturday, March 15, targeting bank ATMs in Montana.

After leaving Thermopolis, the group proceeded to Denver, arriving in the early morning hours on Monday, March 17.

Not the first

Coyne said it wasn't the first time the banks’ ATMs were hit. About 90 days ago, in a middle-of-the-night operation, thieves tried to gain access to the ATMs in Lovell and Greybull.

They were successful in Lovell, but not in Greybull.

“They got a relatively small amount of cash,” Coyne said. “We contacted law enforcement, but at that time, the decision was made to keep it on the down-low to see if we could figure out their MO and maybe be in a position to catch these guys.”

Using surveillance videos, law enforcement was able to apprehend one of the suspects in South Dakota, where he was arrested. That individual has ties to the Venezuelan prison gang turned transnational criminal organization that is operating in the metro Denver region, Blackburn said.

However, investigators have yet to confirm a link between the group that carried out the most recent thefts and the same Venezuelan gang.

“It’s too early to tell,” Blackburn said, “but all indications are that they were very well organized and that at least some of them were in this country illegally.”

Investigation

Coyne said the thefts were discovered around 7 a.m. Monday, March 17 by a staff member who noticed fluctuations in power running to the ATM machines. A check of the video surveillance footage explained why.

Blackburn credited the police in the three affected communities — led by chiefs Travis Davis in Greybull, Roger Haney in Lovell and Pat Cornwell in Thermopolis — for their rapid response.

“The case was so big and so broad, it crossed not only county lines but also state lines,” he said. “The real key was those local jurisdictions getting the information so quickly to the state and federal partners and then the state and federal partners being able to use that to get ahead of the culprits, which is a good lesson. There’s an old police saying: ‘You can’t outrun a Motorola.’ This case was an example.”

Blackburn said the Wyoming DCI, which also “moved mountains” and played a key role, wrote the arrest affidavits and the Big Horn County attorney's office organized them and got them signed.

When the suspects were arrested, it was on Big Horn County warrants.

"They're currently being detained, but we'll be going through the extradition process to get them back here -- for the time being, anyway" Blackburn said. "With it being a nationwide problem, I expect the charges will go federal pretty quickly."

Moving forward

Coyne echoed Blackburn regarding the quick response of local, state and federal law enforcement, adding that U.S. Sen. John Barrasso's office provided an assist as well.

Since the thefts, the FBI has confiscated the bank's ATM hard drives and is doing forensic analysis to see how the thieves are beating the technology in those machines.

Through videos and what he's learned from investigators, Coyne said the ATM thefts are taking about an hour and occurring in stages. They are being done with great precision, often involving multiple people and vehicles.

Coyne said considerably more money was stolen from the three branches than in December, but with insurance kicking in, the actual loss to the bank will be negligible.

"From a customer care standpoint, the way they did these thefts, no customer information was exchanged, so we aren't concerned about that at all," he said. "But the whole process will take our ATMs offline for a while ... likely two to three weeks."

As an added safety measure, the bank will be removing all the components of its ATMs and rebuilding them from the inside out, Coyne said.

Echoing Blackburn's statement about ATM jackpotting becoming a national problem, Coyne said it's resulted in the theft of approximately $3.2 billion, according to FBI estimates.

"A lot of that was happening on the coasts and it's just moving into the heartland," he said. "Now they're preying on the smaller communities that don't have the resources to be 24/7 and track all this stuff."

This story was published on March 27, 2025.