Europol Dismantles AudiA6 Crypto Laundering Network Behind Ransomware Operations

Key Findings

• Europol dismantled AudiA6, an industrial-scale cryptocurrency laundering service that processed over €336 million (~$389 million) in illicit funds since 2021

• Two alleged administrators of Ukrainian and Russian nationality were arrested in Georgia on June 10, 2026

• The operation seized over 30 servers, 25 domains, €692,000 in frozen cryptocurrency, and identified more than 6,000 fraudulent money mule accounts

• AudiA6 operators also ran Dark2Web, a dark web cybercrime forum used by ransomware gangs and threat actors worldwide

• The service charged commissions of 3-10 percent to launder stolen funds through complex transaction chains, typically completing transfers within an hour

Background

AudiA6 emerged in 2021 as a cryptocurrency mixing service marketed to cybercriminals seeking to hide the origins of stolen digital assets. The platform became the go-to financial hub for ransomware operators and cybercriminal networks looking to cash out proceeds from attacks and theft. Operating as an industrial-scale enterprise, AudiA6 managed thousands of fraudulent exchange accounts opened using stolen or purchased identities, making it one of the most significant money laundering operations in the dark web economy.

The Operation Structure

AudiA6 operated a relatively straightforward business model tailored for criminal customers. Clients transferred ill-gotten cryptocurrency to wallets controlled by the group through private messaging platforms. The operators then conducted "cleaned" funds back to the customers within an hour, using deliberately complex transaction chains to obscure the money trail. The service relied heavily on a network of money mules recruited from Russian-speaking intermediaries who helped move criminal proceeds through various cryptocurrency exchanges. The criminals registered money mule accounts using both commercial email providers and domains under their control, a technique that allowed them to maintain operational security while scaling their laundering capacity.

The Dark2Web Connection

Beyond cryptocurrency mixing, the same individuals running AudiA6 also administered Dark2Web, a prominent dark web forum that served as a marketplace for illicit services. Dark2Web functioned as a central meeting place where cybercriminals advertised their services and connected with other threat actors across the globe. This dual operation allowed the administrators to control both the infrastructure and marketplace ecosystems that supported cybercriminal activity, effectively positioning themselves as key facilitators in the broader ransomware economy.

The Investigation and Breakthrough

The investigation that led to AudiA6's disruption began in September 2025 when Polish Police arrested a Ukrainian national suspected of involvement in money laundering connected to the AudiA6 group. This initial arrest proved pivotal. Forensic examination of the suspect's electronic devices allowed investigators to identify additional individuals linked to the operation and begin mapping the broader network. This breakthrough triggered a larger international investigation that eventually resulted in the coordinated takedown operation on June 10, 2026.

International Coordination and Arrests

The June 10 operation represented a massive coordinated effort involving law enforcement from the United States, Poland, and nine other countries. U.S. authorities charged the two arrested individuals—37-year-old Ruslan Igorevich Tkachuk and 25-year-old Alexander Vladimirovich Ledenev—with conspiracy to launder monetary instruments and money laundering. Both face up to 20 years in prison if convicted. The Department of Justice revealed that approximately 393.39 bitcoin stolen directly from darknet markets, ransomware organizations, and other illicit sources had been deposited into AudiA6 wallets, valued at around $19.2 million at the time of transactions.

Scope of Seizures and Takedowns

The coordinated operation resulted in substantial material disruptions. Authorities conducted three property searches, seized over 30 servers, and took down 25 domains hosting AudiA6 infrastructure. In Georgia alone, police seized more than 80 vehicles and multiple properties believed to be connected to the operation. Investigators froze cryptocurrency assets worth €692,000 and seized an additional €86,000 in cryptocurrency. Law enforcement also blocked Telegram accounts used by the network and replaced AudiA6's clear web and dark web sites with official seizure banners, making the operation's disruption publicly visible.

The Money Mule Network

Investigation into AudiA6's operational structure uncovered more than 6,000 Know Your Customer records linked to money mule accounts. These mules were primarily Russian-speaking intermediaries specifically recruited to facilitate the movement of criminal proceeds through legitimate cryptocurrency exchanges. The criminals used a network of fraudulent domains to register these accounts, deliberately diversifying their email infrastructure across multiple providers and controlled domains. The identified domains used in this scheme included designli.pictures, pheontx.eu, smplfy.in, sumato-soft.org, and numerous others, allowing authorities to alert exchanges and help them block future malicious registrations.

Real-World Impact and Connections

AudiA6 had been linked to more than 15 major investigations worldwide related to ransomware attacks and large-scale cryptocurrency theft. The service remained operational until its disruption despite growing awareness in security circles. As recently as December 2025, analysts discovered that funds stolen from the 2022 LastPass breach were routed through AudiA6 and another mixer called Cryptex, demonstrating the service's continued use by major cybercriminal operations even as its exposure grew.

Broader Implications

The dismantling of AudiA6 represents one of the most significant blows to the cybercriminal financial infrastructure in recent years. By cutting off a key money laundering pipeline, authorities have disrupted the ability of ransomware gangs and other cybercriminal networks to convert stolen digital assets into usable funds. However, experts note that the operation also highlights the challenge law enforcement faces in combating industrial-scale cryptocurrency laundering. The sheer volume of fraudulent accounts, domains, and money mules involved demonstrates how sophisticated these operations have become and suggests that similar services will likely continue emerging to fill the void left by AudiA6's takedown.

Sources

• https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html

• https://securityonline.info/crypto-laundering-service-dismantled/

• https://www.sepe.gr/en/it-technology/cybersecurity/22737150/europol-disrupts-audia6-crypto-laundering-service-used-by-ransomware-gangs

• https://x.com/TheHackersNews/status/2065324511634116734

• https://dig.watch/updates/europol-audia6-crypto-laundering-network

• https://www.facebook.com/europol/posts/-an-international-law-enforcement-operation-supported-by-europol-has-dismantled-/1293968736186392