European law enforcement agencies have dismantled AudiA6, a major cryptocurrency laundering operation that allegedly helped ransomware gangs and cybercriminals move hundreds of millions of euros in illicit funds across the globe.
Quick Summary – TLDR:
- Europol and international partners disrupted AudiA6, a crypto laundering service linked to ransomware groups and cybercriminal networks.
- Authorities say the platform laundered more than €336 million in illicit cryptocurrency between 2022 and 2025.
- Two alleged administrators were arrested in Georgia, while domains, servers, cryptocurrency, vehicles, and properties were seized.
- Investigators uncovered links to ransomware payments, darknet markets, and thousands of fraudulent exchange accounts.
What Happened?
A coordinated international law enforcement operation has shut down AudiA6, a cryptocurrency laundering service accused of helping cybercriminals conceal and move stolen digital assets. The action, carried out on June 10, 2026, involved agencies from Europe, the United States, Australia, and several other countries.
Authorities believe AudiA6 played a central role in helping ransomware gangs, darknet operators, and other cybercriminals convert illicit cryptocurrency into funds that were harder for investigators to trace.
‼️𝗠𝗮𝗷𝗼𝗿 𝗯𝗹𝗼𝘄 𝘁𝗼 𝘁𝗵𝗲 𝗿𝗮𝗻𝘀𝗼𝗺𝘄𝗮𝗿𝗲 𝗲𝗰𝗼𝗻𝗼𝗺𝘆.
— CyberX (@CyberXlx9q) June 11, 2026
Europol and international partners have dismantled “AudiA6,” a crypto laundering service allegedly used by ransomware gangs and other cybercriminals to wash illicit proceeds.
Investigators say the platform… pic.twitter.com/g7quaAudMT
A Major Blow to Cybercriminal Finance Networks
According to Europol, AudiA6 operated as a professional cryptocurrency mixing and laundering service. Investigators estimate the platform processed more than €336 million in criminal proceeds between 2022 and 2025.
The service allegedly marketed itself on underground cybercrime forums as a fast and reliable way to transform stolen cryptocurrency into funds that appeared legitimate. Customers reportedly transferred cryptocurrency to wallets controlled by the group and received cleaned funds through a complex chain of transactions designed to obscure the source of the money.
Investigators said the operators charged commissions ranging from 3% to 10% for their services. In one forum advertisement, the service promoted itself as being able to take “dirty cryptocurrency from you and give you a clean one.“
Arrests, Seizures, and Domain Takedowns
The operation resulted in the arrest of two alleged administrators in Georgia. U.S. authorities identified them as Ruslan Igorevich Tkachuk, 37, and Alexander Vladimirovich Ledenev, 25. They have been charged in the United States with money laundering related offenses and could face up to 20 years in prison if convicted.
Law enforcement agencies also carried out extensive seizure actions, including:
- 25 domains seized.
- More than 30 servers taken offline.
- Over 80 vehicles confiscated.
- Multiple properties seized in Georgia.
- €692,000 in cryptocurrency frozen.
- €86,000 in cryptocurrency seized.
- Telegram accounts linked to the network blocked.
Authorities replaced both the clear web and dark web sites associated with AudiA6 and Dark2Web with official law enforcement seizure notices.
Investigation Uncovered Global Criminal Links
The investigation gained momentum after Polish police arrested a Ukrainian national connected to the AudiA6 network in September 2025. Evidence recovered from electronic devices helped investigators identify additional members of the operation.
Europol said AudiA6 was connected to more than 15 active investigations worldwide involving ransomware attacks and large scale cryptocurrency theft.
Australian Federal Police also linked the service to part of a ransom payment made by an Australian business targeted in a ransomware attack during 2024. Officials did not identify the ransomware group involved because the case remains under investigation.
Investigators further discovered more than 6,000 Know Your Customer records connected to money mule accounts. Many were linked to Russian speaking intermediaries recruited to move criminal proceeds through cryptocurrency exchanges.
How the Network Operated?
Authorities described AudiA6 as an industrial scale laundering service that relied on thousands of fraudulent exchange accounts created using stolen or purchased identities.
The operators are also suspected of running Dark2Web, a cybercrime forum used to advertise illegal services and connect threat actors from different countries.
Investigators found that the group used multiple domains and online infrastructure to register mule accounts and move funds through cryptocurrency exchanges while avoiding detection.
The U.S. Department of Justice stated that a portion of the bitcoin handled by the service came directly from known darknet markets, ransomware organizations, cybercrime services, and other illicit sources.
Growing Threat of Professional Crypto Laundering
Europol said the case highlights the growing industrialization of cryptocurrency laundering. Modern cybercriminal groups increasingly rely on specialized services that use chain hopping, decentralized exchanges, and crypto mixers to move funds rapidly across different blockchains.
Law enforcement agencies believe disrupting services such as AudiA6 is critical because these platforms act as financial infrastructure that enables ransomware gangs and other cybercriminal organizations to profit from their attacks.
SQ Magazine Takeaway
I see this operation as one of the most significant strikes against the financial backbone of cybercrime in recent years. Ransomware groups depend on laundering services to turn stolen cryptocurrency into usable money, and taking down a trusted provider like AudiA6 creates real disruption. While cybercriminals will continue looking for new ways to hide their funds, this case shows that international cooperation is becoming increasingly effective at tracking and dismantling the infrastructure that supports online crime.
