Operation Details and Targets
Law enforcement authorities from 11 countries, supported by Europol and Eurojust, have taken down the AudiA6 cryptocurrency laundering service. This platform allegedly served as a central hub for ransomware actors and other cybercriminals to clean illicit funds between 2022 and 2025. The operation resulted in the arrest of two individuals in Georgia, both believed to be administrators of AudiA6 as well as the underground forum Dark2Web.
Europol described the operation as targeting an industrial scale cryptocurrency laundering operation. Investigators uncovered thousands of fraudulent exchange accounts opened using stolen or purchased identities. The U.S. Department of Justice named Ruslan Igorevich Tkachuk, aged 37, and Alexander Vladimirovich Ledenev, aged 25, as senior members of the platform. They face potential sentences of up to 20 years for facilitating cybercrime laundering.
Impact and Scope
AudiA6 marketed itself as a professional cryptocurrency mixing service, accepting cybercrime proceeds and returning cleaned funds within about an hour for a 3% to 10% commission. Analysis by Europol linked the service to more than 15 international investigations involving ransomware attacks and large scale cryptocurrency theft. The DoJ noted that out of approximately 10,333 bitcoin deposited, about 393.39 BTC directly came from known darknet markets, ransomware organizations, and cybercrime services.
Authorities seized 25 domains, 80 vehicles and properties, and substantial cryptocurrency holdings. They also retrieved 6,000 Know Your Customer (KYC) records linked to money mule accounts, many connected to Russian speaking intermediaries. The takedown followed the arrest of a Ukrainian national in Poland in September 2025, whose device forensic examination helped identify key figures behind the operation. Both AudiA6 and Dark2Web websites now display seizure notices.
Source: BleepingComputer
