It was 2:47 a. m. in a quiet German town when a deafening explosion shattered the silence. Alarms echoed through the streets as two masked men emerged from the debris, hauling cash boxes into a stolen car.
Within seconds, they were gone, leaving behind the wreckage of an ATM and a scene of chaos. The incident in Kirit, Germany, on February 1, 2023, was not an isolated robbery. It was part of a growing wave of ATM bombings sweeping across Europe, a criminal trend that turned cash machines into explosive targets of profit and destruction. In Kirit that night, a black Audi screeched to a halt outside a local bank.
Two men, faces concealed by dark masks, moved quickly and confidently toward their target—an ATM just inside the bank’s glass doors. They attached something to the machine and triggered a first explosion, but the ATM remained stubbornly intact. Undeterred, they prepared a second blast. This time, the explosion ripped the ATM apart, exposing its contents.
But the delay had cost them—a neighbor startled awake by the chaos had already called police, and sirens grew louder in the distance. The men scrambled to gather cash-stuffed boxes into the Audi and took off, but the getaway wasn’t clean. A high-speed pursuit followed, with suspects using laser pointers to blind pursuing officers—a crude but effective tactic that forced one patrol car off the road. They momentarily thought they’d lost their pursuers, but a police helicopter equipped with heat-detecting cameras tracked their every move.
The chase ended when the suspects made a wrong turn into a dead-end street. They ditched the car and fled on foot into a nearby forest, but their every move was monitored from above. Within minutes, officers flooded the area and apprehended all three suspects. They turned out to be from Amsterdam, a city infamous for its links to organized crime.
This was no random heist. In 2022 alone, over 450 ATMs were blown open by criminals in Germany, making it the most prolific year for these attacks in the country’s history. Germany’s reliance on cash made its ATMs attractive targets, with most machines holding anywhere from 20,000 to 60,000 euros at a time, often protected by nothing more than basic security cameras and thin glass doors. The technique was surprisingly straightforward.
Attackers identified ATMs in isolated areas with minimal surveillance, then used silicone and industrial-grade hoses to seal the machine’s vents before filling it with a volatile gas mixture. A small spark from a fuse ignited the gas, triggering an explosion that ripped the ATM apart. The method was effective but risky—a single miscalculation could result in injury or even death. As German police adapted, so did the criminals.
High-potency explosives like Sepex and bkk became the new standard. These materials didn’t just destroy the ATM—they often leveled entire sections of buildings, leaving behind craters of destruction. One such case occurred in the small town of Gandera. A resident was jolted awake by a deafening blast and saw flames engulfing a nearby ATM.
Two masked men emerged from the chaos, lugging cash boxes into a waiting car. Police responded quickly, but the suspects were expert drivers who evaded capture and disappeared into the night. As investigators connected the dots, one city kept surfacing: Amsterdam. The German police, working closely with Europol, identified a particular neighborhood in Amsterdam where stolen cars linked to the heists were often abandoned.
Surveillance footage frequently captured vehicles speeding out of Germany and into the Netherlands. Investigators found a growing network of young men, many of them recent immigrants or second-generation residents, drawn into this lucrative operation. Recruits were trained in safe houses scattered across Amsterdam and nearby cities, where they practiced assembling and detonating homemade explosives on decommissioned ATMs. Footage recovered later revealed meticulous training sessions—step-by-step instructions on rigging machines, timing blasts, and extracting cash within seconds of detonation.
The operation wasn’t limited to Germany. Reports of similar attacks began surfacing in Belgium, France, and even Denmark. The criminals’ ability to move across borders with ease made them especially difficult to track, but the trail kept leading back to Amsterdam—a city quickly becoming the epicenter of Europe’s ATM bombing epidemic. In late 2022, the quiet neighborhood of Utrecht, Netherlands, was rocked by a massive warehouse explosion that sent debris scattering for blocks.
Investigators uncovered something far more sinister than an industrial accident: the warehouse was a fully operational training facility for ATM bombers. Inside the wreckage were disassembled ATMs, caches of explosive materials, and encrypted electronic devices. Investigators also found professionally produced video tutorials and handwritten instructions detailing how to construct bombs and breach cash machines. These tutorials weren’t limited to local use.
They were sold via encrypted apps like Telegram and Signal, enabling aspiring criminals across Europe to buy step-by-step guides on cracking ATMs. The demand was enormous, turning these guides into a lucrative business model. Further inquiries revealed a network of training centers spread across cities like Amsterdam and Utrecht, disguised as legitimate businesses—an artist studio in one case, a storage facility in another. Recruits underwent rigorous training on constructing explosives, handling getaway cars, and practicing on real ATMs.
For those unable to attend in-person training, the syndicate offered comprehensive training packages sold on the dark web. The investigation took a darker turn when authorities traced the source of the explosives to Eastern Europe. Military-grade materials like Sepex, commonly used in paramilitary operations, were flowing through underground networks, linking the local ATM bombers to larger international syndicates. This discovery shifted the scope of the investigation, revealing that what appeared to be a localized crime wave was in fact a transnational operation with global connections.
As investigators unraveled the operation, one name kept surfacing: the Mocro Mafia. This North African-origin criminal network, notorious for its grip on the Dutch and Belgian underworld, had already been implicated in drug trafficking and high-profile assassinations. Now it appeared they were also deeply involved in ATM bombings. What set the Mocro Mafia apart was their systematized approach.
Young recruits were groomed, trained, and equipped for their roles—drivers specialized in high-speed getaways while explosives experts handled dangerous materials. Above them, coordinators orchestrated operations from hidden bases in Amsterdam and Utrecht. A pivotal case highlighted their involvement. In 2016, an ATM heist in Mainz, Germany, went awry when the getaway car crashed, killing one suspect and seriously injuring another.
Among the perpetrators was Anouar Taghi, a cousin of Ridouan Taghi, the infamous leader of the Mocro Mafia. While Anouar managed to evade immediate capture, his eventual arrest reinforced suspicions about the mafia’s role in these crimes. Ridouan Taghi, often called the “Pablo Escobar of Europe,” controlled a significant share of Europe’s cocaine trade and was linked to a string of murders. Investigators believe proceeds from ATM heists were reinvested into the mafia’s broader empire, fueling drug shipments, bribery, and arms deals.
The mafia didn’t shy away from brutality—one lawyer representing a key witness was assassinated in broad daylight, sending a chilling message that the Mocro Mafia would protect its interests at any cost. By late 2022, law enforcement had gathered enough evidence to act. Europol coordinated an unprecedented task force involving German, Dutch, and Belgian police. Surveillance operations ran day and night, tracking suspects, intercepting communications, and mapping the organization’s web of operatives.
The breakthrough came when a shipment of Sepex explosives was intercepted en route to Amsterdam. It confirmed fears that the group was preparing for larger, deadlier heists. In early 2023, authorities executed synchronized raids across multiple cities. Over 300 officers stormed warehouses, training facilities, and safe houses in Amsterdam—the suspected nerve center of the operation.
They uncovered a chilling scene: a cache of explosives, dozens of disassembled ATMs, and encrypted devices brimming with operational data. It was a criminal enterprise on an industrial scale. Nineteen suspects were arrested, including logistics coordinators and bomb-making specialists with ties to the Mocro Mafia. Authorities seized 2.
5 million euros in cash, weapons, and materials capable of leveling buildings. Most importantly, they received encrypted files revealing the organization’s sprawling network linking ATM bombings to drug trafficking and money laundering operations. The raids struck a major blow to the Mocro Mafia, disrupting their operations at the source for the first time. The arrests sent shockwaves through the underworld, forcing the group to scramble and adapt.
But victory came with a sobering realization: the fight was far from over. Despite the arrests, ATM bombings continued in the weeks that followed. The Mocro Mafia was too decentralized to be dismantled in one strike, and the training materials seized during the raids had already made their way onto the dark web. The techniques for turning ordinary ATMs into explosive jackpots were now accessible to a new wave of criminals.
In Germany, the scars of the bombings were evident. Small towns and rural areas faced mounting insurance claims, shattered storefronts, and displaced residents. Some banks chose not to replace their ATMs, leaving communities without easy access to cash. Meanwhile, the Netherlands dealt with the fallout from the arrests.
Ridouan Taghi’s empire, already weakened by years of police pressure, suffered a financial blow, but it was clear the organization would pivot, likely expanding its drug trade dominance to compensate. One discovery from the encrypted devices stood out: detailed blueprints for replicating the training network across Europe. These guides outlined how to establish similar operations, complete with bomb recipes and encrypted communication methods. The operation was hailed as a success, but the challenges ahead were daunting.
Could law enforcement dismantle the Mocro Mafia entirely, or would their fragmented structure ensure their survival? For now, the raids had bought time, but it was clear that this was just one chapter in a much larger and ongoing battle—Europe had won a critical battle, but only the first step in a much longer war.
