Trump Warned of a Tren de Aragua ‘Invasion.’ US Intel Told a Different Story

As the Trump administration publicly cast Venezuela’s Tren de Aragua (TdA) as a unified terrorist force tied to President Nicolás Maduro and operating inside the United States, hundreds of internal US government records obtained by WIRED tell a far less certain story. Intelligence taskings, law-enforcement bulletins, and drug-task-force assessments show that agencies spent much of 2025 struggling to determine whether TdA even functioned as an organized entity in the US at all—let alone as a coordinated national security threat.

While senior administration officials portrayed TdA as a centrally directed terrorist network active across American cities, internal tasking directives and threat assessments repeatedly cite “intelligence gaps” in understanding how the group operated on US soil: Whether it had identifiable leadership, whether its domestic activity reflecting any coordination beyond small local crews, and whether US-based incidents pointed to foreign direction or were simply the work of autonomous, profit-driven criminals.

The documents, marked sensitive and not intended for public disclosure, circulated widely across intelligence offices, law-enforcement agencies, and federal drug task forces throughout the year. Again and again, they flag unresolved questions about TdA’s US footprint, including its size, financing, and weapons access, warning that key estimates—such as the number of members operating in the US—were often inferred or extrapolated by analysts due to a lack of corroborated facts.

Together, the documents show a wide gap between policy-level rhetoric and on-the-ground intelligence at the time. While senior administration officials spoke of “invasion,” “irregular warfare,” and “narco-terrorism,” field-level reporting consistently portrayed Tren de Aragua in the US as a fragmented, profit-driven criminal group, with no indication of centralized command, strategic coordination, or underlying political motive. The criminal activity described is largely opportunistic—if not mundane—ranging from smash-and-grab burglaries and ATM “jackpotting” to delivery-app fraud and low-level narcotics sales.

In a March 2025 proclamation invoking the Alien Enemies Act, President Donald Trump claimed the gang had “thousands” of members who had “unlawfully infiltrated the United States” and were “conducting irregular warfare and undertaking hostile actions.” He claimed the group was “aligned with, and indeed has infiltrated, the Maduro regime,” warning that Venezuela had become a “hybrid criminal state” invading the US.

At the same time, however, an internal Border Patrol assessment obtained by WIRED shows officials could not substantiate those claims, relying instead on interview-based estimates rather than confirmed detections of gang members entering the US.

In a Fox News interview the same month, US attorney general Pam Bondi called TdA “a foreign arm of the Venezuelan government,” claiming its members “are organized. They have a command structure. And they have invaded our country.” Weeks later, in a Justice Department press release announcing terrorism and drug-distribution charges against a TdA suspect, Bondi insisted it “is not a street gang—it is a highly structured terrorist organization that put down roots in our country during the prior administration.”

Documents show that inside the intelligence community, the picture appeared far less settled. Although TdA’s classification as a foreign terrorist organization—following a February 2025 State Department designation—immediately reshaped policy, internal correspondence shows the group remained poorly understood even by senior counterterrorism officials, including those at the National Counterterrorism Center. Unresolved questions about TdA—alongside newly designated drug cartel entities in Mexico—ultimately prompted intelligence managers to issue a nationwide tasking order, directing analysts to urgently address the US government’s broad “knowledge gaps.”

The directive, issued May 2, 2025, underscores the breadth of these intelligence gaps, citing unresolved questions about whether the entities had access to weapons beyond small arms, relied on bulk-cash shipments, cryptocurrencies, or mobile payment apps, or were supported by corrupt officials or state-linked facilitators overseas.

In a statement, a spokesperson for Director of National Intelligence Tulsi Gabbard attributed the shortfall to competing priorities, telling WIRED that the “Intelligence Community was unable to devote collection resources towards TdA” prior to the Trump administration giving it the “terrorist” label. “This is where the ‘knowledge gaps’ stem from.”

The tasking order makes clear those uncertainties extended beyond TdA’s past activity to its potential response under pressure. Issued by national intelligence managers overseeing counterterrorism, cyber, narcotics, and transnational crime, it flagged a lack of insight into how TdA and several Mexican cartels might adapt their operations or shift tactics in response to intensified US enforcement.

Similar limits surface in records from White House-run interagency task forces known as HIDTA (High Intensity Drug Trafficking Areas), which show counter-narcotics officials, too, were working with a materially limited understanding of TdA’s activities. In a July 2025 bulletin, a Northern California task force acknowledged that available intelligence failed “to meet the Department of Justice definition of a drug trafficking organization,” adding that TdA subsets “appear to operate independently of each other and do not appear to operate as part of a larger coordinated effort.”

TdA members are “not known to have assigned roles,” the report notes, adding that “leadership formation has not yet been identified.”

Additional HIDTA reporting likewise fails to identify a sprawling narco-terror enterprise publicly described by senior officials. A “2026 Threat Assessment” covering North Texas and Oklahoma identifies Mexican cartels as the dominant narcotics threat, while characterizing TdA activity as “street level.” That assessment drew on survey responses from dozens of law enforcement agencies and was compiled by a task force that included police chiefs, sheriffs, US attorneys, district attorneys, and senior officials from the FBI, DEA, DHS, and Secret Service, among others.

Assessments by Customs and Border Protection broke sharply from broader law enforcement perspectives. Beginning in mid-March, CBP began producing its own intelligence products, quickly ascribing TdA with both the “capability and intent” to carry out attacks inside the United States; ranking it among the “most capable” foreign terrorist groups, listing it above Hezbollah and Iran’s Revolutionary Guard Corps, while also acknowledging it had no knowledge of any “specific or credible threat.”

CBP and the Department of Homeland Security did not respond to questions or requests for comment.

Just before April, CBP unveiled a much longer “sensitive but unclassified” assessment. The report describes TdA as a growing national security concern, citing its exploitation of US-bound migration and a range of criminal activity from money laundering, to extortion, to human smuggling. The report, which drew from across border enforcement, intelligence offices, and the FBI’s own gang intelligence center, warned readers on its interagency network that its findings relied on “analytical judgments that are not fact, knowledge, or proof,” adding that it might not always distinguish in print between assumption and fact.

The same report acknowledges significant uncertainty about TdA membership figures, identifying markers, and whether US-based subsets coordinate or respond to centralized leadership. In a section titled “Intelligence Gaps,” the agency outlines unresolved issues, including the movement of criminal proceeds and where the network might seek to expand in the US. Those uncertainties culminated in a question that, publicly, the White House claimed to have already answered: “Are US-based TdA members operating under the direction of foreign-based leadership?”

The following month, a classified National Intelligence Council assessment, first reported by The Washington Post, found no evidence that TdA was directed by the Venezuelan government. When asked about the findings, the Office of the Director of National Intelligence dismissed the assessment—representing the consensus view of most US intelligence agencies—as the work of “deep state actors” acting in conjunction with the media.

Elsewhere, the CBP report undercuts assertions that the government had a clear picture of TdA’s footprint in the US. It notes that it was “difficult for US law enforcement and the intelligence community to ascertain the exact number” of TdA members due to a “lack of determinate indicators” and the “adoption of the TdA name by unaffiliated groups and persons.” Ultimately, those limitations became justification for bending statistics to support the administration’s framing of a US-based terrorist threat numbering in the “thousands.”

Over a 22-month period, CBP’s own detection methods identified no more than 83 known TdA members at the border. To reach a much larger figure, the record shows analysts relied on a “sample set of interviews,” extrapolating that “upwards of 3,000” TdA members must have crossed the border during that same period—an estimate based on the assumption that roughly “one-half of one percent” of all Venezuelan migrants who entered the US through the southwest border had ties to TdA.

The same assumption underlies the report’s treatment of Venezuelan asylum communities, which it frames as potential risk environments shaped by “sanctuary city” policies and jurisdictions the agency views as “weak” on enforcement.

In remarks Tuesday, Trump leaned into the same framing, accusing Democratic-led cities of giving gangs room to operate. Speaking in Detroit, he said that, starting on February 1, the federal government would seek to economically punish cities and states that limit cooperation with the federal government, pledging to cut off “any payments to sanctuary cities or states having sanctuary cities,” which he accused of doing “everything possible to protect criminals.”

The speech came as federal enforcement operations have expanded into hostile occupations of major US cities—deployments and mass arrests that have swept up citizens as well as immigrants, prompting protests and legal challenges from states and municipalities.

Trump singled out Venezuela in particular. “I was so angry with Venezuela,” he said. “They emptied their prisons, almost entirely emptied their prisons, into the United States.”

At the FBI, TdA’s terrorism designation sat uneasily alongside the bureau’s own prior analysis. In internal assessments before the 2024 election, the FBI described TdA as an unsophisticated compared to traditional “South American theft groups,” finding its members favored “opportunistic,” often “spontaneous” crimes, with a focus on retail theft from big-box stores and exploiting other Venezuelan and South American migrants. While the bureau consistently warned of TdA’s propensity for violence, it failed to find any coordination among members inside the US or note any evidence of complex, preplanned operations.

In 2025, FBI field-level reporting appears to have remained focused on conventional crimes, including passing references to human, weapons, and narcotics trafficking with little accompanying detail. In April, a joint situation report filed by Alabama and Tennessee field offices linked TdA to a “retail theft crew” suspected of smash-and-grab burglaries at Walmart jewelry counters in the region. While the report notes similar incidents nationwide—with losses estimated at roughly $1.2 million—it implicates only a single “confirmed” Tren de Aragua member, and makes no reference to any national-security-level threat.

The reports sit alongside public statements from FBI director Kash Patel, who, also in April, described TdA publicly as “a direct threat to our national security,” vowing to eliminate what he called a “violent terrorist organization.” Inside the bureau, records show, its Terrorism Screening Center responded by convening a “Tren de Aragua Interagency Working Group” to coordinate watch listing changes. A distribution list obtained by WIRED shows an April 2025 meeting drew participants from numerous DHS and Justice Department components, both State and Treasury, and elements of the intelligence community and military, alongside dozens of state and local agencies and fusion centers.

Reached for comment, the FBI declined to respond to questions about differences between its internal reporting and how TdA was characterized publicly by leadership. It did not acknowledge the existence of any terrorist threat, saying only that it remains steadfast in its “commitment to working with our local, state, and federal partners to combat violent gang activity in our communities, including illegal acts carried out by the Venezuelan criminal gang, Tren de Aragua.”

Similar low-level depictions of TdA activity appear in regional drug-task-force reporting. A June 2025 Northern California threat assessment noted that TdA “did not appear to be directly involved in drug trafficking,” similarly linking the group instead primarily to organized retail theft, alongside suspected involvement in “at least two shootings.” A separate assessment covering North Texas and Oklahoma alleged a connection between TdA and Walmart’s delivery app, Spark, citing suspected identity theft used to “exploit the delivery driver profession to facilitate financial fraud.”

CBP issued a similar warning the following month citing an unattributed law enforcement report, alleging TdA members had been exploiting food delivery and rideshare platforms as a source of income and a means to allegedly facilitate routine criminal activity.

According to the bulletin, TdA members—including some with “direct ties to TdA leadership”—used services such as Uber, DoorDash, and Grubhub by renting or sharing accounts obtained through personal networks or online forums. One individual, “a known TdA member and Uber driver,” it claims, “frequently delivers food and drugs to individuals living in a migrant shelter.” Others were said to be using malicious software to “steal high-fee delivery orders from other drivers.”

Walmart, Uber, GrubHub, and DoorDash did not immediately respond to requests for comment.

The document mirrors myriad other reports of sporadic crimes being loosely attributed to the group using vague attribution and low-confidence language. In August, a law-enforcement bulletin on ATM “jackpotting,” circulated by the Texas Financial Crimes Intelligence Center, warned that suspects involved in ATM malware attacks “may be associated” with TdA.

In a separate August bulletin, the New York Police Department’s Intelligence & Counterterrorism Bureau warned partners that TdA members might be attempting to infiltrate the local music scene. People “allegedly affiliated with TdA have hosted parties involving DJs,” officials said, adding that the gatherings “may be” an effort “to potentially further engage in, or promote criminal activity.”

In written responses to WIRED, the Office of the Director of National Intelligence invoked America’s war in Afghanistan to explain the framework it applies to Venezuela, pointing to a conflict that stretched two decades, consumed trillions of dollars, and saw tens of thousands of civilians and security personnel killed, in addition to nearly 2,500 US service members. Just as it found no evidence to support the claim that Maduro’s government was directing TdA, the office added, “The Taliban was never assessed to be directing al-Qaeda’s attacks.”