European authorities have dismantled AudiA6, a cryptocurrency laundering service utilized by ransomware syndicates and cybercriminal networks.
In a statement released on Thursday, Europol stated that the takedown of AudiA6 severed a "key financial pipeline used to wash hundreds of millions in illicit profits." The service is believed to have laundered over €336 million (approximately $389 million) since it began operations in 2021.
"The platform became a central hub for ransomware actors and cybercriminals seeking to cash out stolen digital assets while hiding the money trail from authorities," the agency added.
The operators of AudiA6 are suspected of also managing a dark web cybercrime forum called Dark2Web, where cybercriminals advertised illegal services and connected with other threat actors globally.
As part of the operation conducted on June 10, 2026, a series of coordinated actions were executed, including:
- The arrest of two alleged administrators of Ukrainian and Russian nationality in Georgia - Three property searches - Takedown of 25 domains and seizure of more than 30 servers - Seizure of over 80 vehicles and multiple properties in Georgia - Freezing of cryptocurrency assets worth €692,000 ($798,000) and confiscation of €86,000 ($99,400) in cryptocurrency - Blocking of Telegram accounts used by the network - Replacement of the clear web and dark web sites of AudiA6 and Dark2Web with a law enforcement seizure notice
Simultaneously, the U.S. Department of Justice (DoJ) announced charges against the two arrested individuals—Ruslan Igorevich Tkachuk, 37, and Alexander Vladimirovich Ledenev, 25—accusing them of one count of conspiracy to launder monetary instruments and one count of sting money laundering. If convicted, both face a maximum sentence of 20 years in prison.
"Out of the approximately 10,333 bitcoin deposited, approximately 393.39 BTC (valued at around $19,234,331 at the time of the transactions) were received directly from known darknet markets, ransomware organizations, cybercrime services, and other illicit sources, while additional funds were deposited indirectly from illicit sources into AudiA6 wallets," the DoJ stated.
Europol noted that the crackdown resulted from an earlier enforcement action by the Polish Police, which led to the arrest of a Ukrainian national in September 2025 for alleged involvement in money laundering activities linked to the AudiA6 group.
This allowed authorities to conduct a forensic examination of the suspect's seized electronic devices and identify additional individuals connected to the operation.
AudiA6 has been characterized as an industrial-scale cryptocurrency laundering operation that relied on thousands of fraudulent exchange accounts opened using stolen or purchased identities. The criminal service has been tied to more than 15 investigations worldwide related to ransomware attacks and large-scale cryptocurrency theft.
Before its disruption, AudiA6 was promoted as a cryptocurrency mixing service guaranteeing anonymity and speed. It allowed customers to transfer their ill-gotten proceeds to wallets controlled by the group and receive "cleaned" funds in return within an hour through a "complex chain of transactions" designed to hide the origin of the funds.
These transactions occurred over private messaging platforms, with the operators charging commissions ranging from 3 percent to 10 percent.
"More than 6,000 Know Your Customer (KYC) records linked to money mule accounts were identified during the investigation," Europol said. "Many of the mule accounts were connected to Russian-speaking intermediaries recruited specifically to help move criminal proceeds through cryptocurrency exchanges."
AudiA6 is also reported to have used both commercial email providers and email addresses linked to domains under their control to register money mule accounts with various cryptocurrency exchanges. The names of the domains are listed below:
- designli.pictures - pheontx.eu - smplfy.in - sumato-soft.org - technobrains.dev - lett.email - trayo.app - deliverly.top - inboxly.top - postfast.eu - postino.click - inboxally.agency - mailora.eu - postify.email - quix.express - flowcomm.click - qube.black - deliverlett.com - lettermail.eu
In a report published in November 2021, Intel 471 revealed that AudiA6 required a minimum balance of 27 bitcoins and charged a flat service fee between 3 percent and 5.5 percent. As recently as December 2025, a TRM Labs analysis found that funds stolen from the 2022 LastPass hack were routed through Cryptex and AudiA6.
The investigation was conducted by the United States Secret Service and the IRS Criminal Investigation, along with the Polish Police and law enforcement partners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the U.K.
The findings highlight the emergence of industrial-scale cryptocurrency laundering services that fuel the cybercrime economy, as well as the use of fraudulent exchange accounts, mule wallets, and privacy-focused tools designed to obscure the money trail and circumvent anti-money laundering controls.
"Ransomware groups and cybercriminal networks are increasingly relying on chain-hopping, decentralised exchanges and 'mixer-as-a-service' platforms to move illicit cryptocurrency across multiple blockchains within minutes, helping criminal profits disappear into the digital underground," Europol said.