12.06.2026
3 min
7
Law enforcement authorities have dismantled the cryptocurrency service AudiA6, which was allegedly used by ransomware operators and other cybercriminals to launder more than $380 million in illicit funds.
Europol says the AudiA6 service has been linked to more than 15 international investigations involving ransomware attacks and large-scale cryptocurrency theft. Investigators believe the platform operated as a major money-laundering hub between 2022 and 2025.
“Investigators uncovered what they describe as an industrial-scale cryptocurrency laundering operation built around thousands of fraudulent exchange accounts opened using stolen or purchased identities,” Europol said.
“The analysis conducted by Europol linked the criminal service to more than 15 investigations worldwide involving ransomware attacks and large-scale cryptocurrency theft.”
AudiA6 marketed itself as a professional cryptocurrency mixing service. In reality, it accepted proceeds from cybercrime, routed the funds through complex transaction chains designed to conceal their origin, and returned the cryptocurrency to its owners in a “cleaned” form within about an hour, charging a service fee of 3% to 10%.
The investigation involved law enforcement agencies from 11 countries across Europe, the Americas, and Asia, with support from Europol and Eurojust. According to Europol, the operation was made possible by the September 2025 arrest in Poland of a Ukrainian national linked to AudiA6.
Forensic analysis of the suspect’s devices helped investigators identify key individuals behind the operation, ultimately leading to their arrest in Georgia.
As a result of the operation, authorities:
Arrested two individuals in Georgia;
Seized three properties;
Took down 25 domains;
Confiscated 80 vehicles and other assets;
Seized €86,000 ($99,000) in cryptocurrency;
Froze €692,000 ($798,000) in cryptocurrency assets;
Blocked Telegram accounts used by the network.
Authorities believe the two arrested suspects, a Ukrainian and a Russian national, were administrators of both AudiA6 and the underground forum Dark2Web, which cybercriminals used to advertise illegal services.
The AudiA6 and Dark2Web websites now display law enforcement seizure notices.
The U.S. Department of Justice identified 37-year-old Ruslan Ihorovych Tkachuk and 25-year-old Oleksandr Volodymyrovych Ledieniev as senior members of the AudiA6 platform.
Both men are currently in Georgian custody and face up to 20 years in prison for facilitating cybercrime-related money laundering operations.
“Of approximately 10,333 Bitcoin deposited, approximately 393.39 BTC (worth about $19,234,331 at the time of the transactions) was received directly from known darknet marketplaces, ransomware actors, cybercrime services, and other illicit sources, while additional funds were indirectly deposited from unlawful sources into AudiA6 wallets,” the U.S. Department of Justice stated.
In addition to the two administrators, authorities also seized 6,000 Know Your Customer (KYC) records linked to money mule accounts. Europol said these accounts were created using stolen or purchased identities, and many were connected to Russian-speaking brokers who recruited individuals specifically for this purpose.
The vast money mule network used multiple domains to register accounts on cryptocurrency exchanges. Europol has published details of those domains to raise awareness and help platforms identify and block similar fraudulent activity.
