Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs

Authorities in Europe, with the assistance of Europol, have successfully dismantled AudiA6, a cryptocurrency laundering service heavily utilized by ransomware gangs and cybercriminal networks. This operation has effectively severed a major financial conduit that was responsible for laundering over €336 million (approximately $389 million) since its inception in 2021. AudiA6 served as a central hub for cybercriminals to obscure the origins of their illicit digital assets, making it a significant target for law enforcement agencies. The operators of AudiA6 were also linked to a dark web cybercrime forum known as Dark2Web, which facilitated the advertisement and exchange of illicit services among global threat actors. The crackdown, executed on June 10, 2026, involved a series of coordinated actions, including the arrest of two alleged administrators of Ukrainian and Russian nationality in Georgia. Additionally, authorities conducted property searches, took down 25 domains, and seized over 30 servers, along with 80 vehicles and multiple properties. In conjunction with these efforts, the U.S. Department of Justice (DoJ) has filed charges against the two arrested individuals, Ruslan Igorevich Tkachuk and Alexander Vladimirovich Ledenev. They are accused of conspiracy to launder monetary instruments and sting money laundering, with potential sentences of up to 20 years in prison. The DoJ revealed that a significant portion of the cryptocurrency handled by AudiA6 originated from known darknet markets and other illicit sources. The operation was a culmination of previous enforcement actions, notably an arrest by the Polish Police in September 2025, which led to the forensic examination of seized electronic devices. This investigation uncovered additional individuals involved in the AudiA6 operation. AudiA6 was identified as an industrial-scale operation that utilized thousands of fraudulent exchange accounts, opened with stolen or purchased identities, to facilitate large-scale cryptocurrency laundering. Prior to its disruption, AudiA6 was marketed as a cryptocurrency mixing service, offering anonymity and rapid transactions. It allowed clients to transfer illicit funds to the group’s wallets and receive "cleaned" funds through a complex chain of transactions. These services were facilitated via private messaging platforms, with operators charging commissions ranging from 3 to 10 percent. During the investigation, Europol identified over 6,000 Know Your Customer (KYC) records linked to money mule accounts, many of which were associated with Russian-speaking intermediaries. These intermediaries were specifically recruited to move criminal proceeds through cryptocurrency exchanges. AudiA6 also utilized commercial email providers and custom domains to register mule accounts, further complicating the tracking of illicit activities. The investigation, supported by the United States Secret Service, IRS Criminal Investigation, and law enforcement agencies from multiple countries, highlights the growing trend of industrial-scale cryptocurrency laundering services. These services exploit fraudulent exchange accounts and privacy-focused tools to obscure money trails and evade anti-money laundering controls. Europol noted that ransomware groups increasingly rely on such platforms to move illicit cryptocurrency across blockchains, effectively concealing criminal profits. This case underscores the challenges faced by law enforcement in combating sophisticated cybercrime networks that leverage advanced technologies to facilitate illegal activities. The dismantling of AudiA6 represents a significant victory in the ongoing battle against cybercrime and highlights the importance of international cooperation in tackling these complex issues.