Europol Shuts Down AudiA6 Cryptocurrency Laundering Service Linked to Ransomware Gangs
June 12, 2026 — In a major law enforcement breakthrough against cybercrime, Europol announced the disruption of AudiA6, an industrial-scale cryptocurrency laundering platform widely used by ransomware gangs and other cybercriminal networks. This action dealt a significant blow to a key financial pipeline facilitating the laundering of hundreds of millions of euros in illicit profits.
AudiA6: A Central Hub for Ransomware Money Laundering
According to Europol’s statement on June 11, 2026, AudiA6 had been operational since 2021, laundering an estimated €336 million (approximately $389 million) by concealing and cleaning digital assets acquired through cybercrime. The service gained notoriety as a preferred platform for anonymizing proceeds from ransomware attacks, darknet market transactions, and other illicit activities.
"The platform became a central hub for ransomware actors and cybercriminals seeking to cash out stolen digital assets while hiding the money trail from authorities," Europol remarked.
Beyond laundering, operators running AudiA6 are also suspected to have managed Dark2Web, a dark web cybercrime forum serving as a marketplace and communication platform for criminal actors globally.
Coordinated Global Enforcement Operation
The takedown effort, conducted on June 10, 2026, was part of a multi-country coordinated law enforcement operation involving agencies from Europe, North America, and beyond. Key results from the operation include:
- Arrest of two alleged AudiA6 administrators of Ukrainian and Russian nationality in Georgia.
- Execution of three property searches within Georgia.
- Seizure and takedown of 25 domain names linked to the laundering service.
- Confiscation of over 30 servers used in AudiA6 operations.
- Seizure of more than 80 vehicles and multiple real estate properties.
- Freezing of cryptocurrency wallets holding assets valued at €692,000 ($798,000).
- Additional seizure of €86,000 ($99,400) in cryptocurrency.
- Blocking of Telegram accounts utilized to coordinate criminal activities.
- Replacement of AudiA6 and Dark2Web websites — on both the clear and dark web — with law enforcement seizure banners.
U.S. Department of Justice Charges and Details
In parallel with Europol’s announcement, the U.S. Department of Justice (DoJ) charged the two arrested individuals—Ruslan Igorevich Tkachuk, 37, and Alexander Vladimirovich Ledenev, 25—with conspiracy to launder monetary instruments and engaging in money laundering. Both face up to 20 years in prison if found guilty.
The DoJ highlighted that of the roughly 10,333 bitcoins processed through AudiA6, approximately 393.39 BTC (worth around $19.2 million at the time of transaction) originated from darknet markets, ransomware groups, and other illicit sources, either directly or indirectly funneling funds into laundering wallets managed by the platform.
Background and Investigation
The crackdown stemmed from an earlier enforcement action by Polish Police, which led to the capture of a Ukrainian suspect in September 2025 connected to the AudiA6 laundering network. Forensic analysis of seized electronic devices enabled investigators to identify additional operatives and infrastructure linked to the operation.
AudiA6 functioned as an anonymizing cryptocurrency mixing service, guaranteeing rapid and discreet transactions. Customers paid commissions between 3% and 10% to transfer stolen funds into the service’s wallets and receive “clean” cryptocurrency in return within roughly an hour. The laundering process involved complex transaction chains intended to obscure the source of funds.
Investigators uncovered over 6,000 Know Your Customer (KYC) records tied to money mule accounts used to move funds through exchanges, many managed by Russian-speaking intermediaries recruited to facilitate illicit money flows. AudiA6 also exploited domain-controlled email addresses and commercial email providers to register mule accounts on various cryptocurrency exchanges, employing fraudulent identities.
A partial list of suspicious domains affiliated with the service includes:
- designli.pictures
- pheontx.eu
- smplfy.in
- sumato-soft.org
- technobrains.dev
- lett.email
- trayo.app
- deliverly.top
- inboxly.top
- postfast.eu
- postino.click
- inboxally.agency
- mailora.eu
- postify.email
- quix.express
- flowcomm.click
- qube.black
- deliverlett.com
- lettermail.eu
Industry reports from Intel 471 in 2021 and TRM Labs in 2025 revealed AudiA6’s role in laundering funds stolen in high-profile breaches such as the 2022 LastPass hack.
International Effort and Implications
The investigation enlisted the collaborative efforts of the United States Secret Service, IRS Criminal Investigation, Polish Police, and law enforcement partners across Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the United Kingdom.
Europol emphasized that the AudiA6 disruption illustrates the rise of industrial-scale cryptocurrency laundering operations enabling the expanding cybercrime economy. These networks increasingly rely on fraudulent exchange accounts, mule wallets, decentralized platforms, and privacy-enhancing techniques to obscure money trails and evade anti-money laundering controls.
"Ransomware groups and cybercriminal networks are increasingly relying on chain-hopping, decentralized exchanges, and ‘mixer-as-a-service’ platforms to move illicit cryptocurrency across multiple blockchains within minutes, helping criminal profits disappear into the digital underground," Europol noted.
Conclusion
This significant enforcement milestone not only curtails a vital laundering channel but also sends a strong message to cybercriminals exploiting cryptocurrency’s anonymity for profit. Continued international cooperation and sophisticated forensic methods remain critical in addressing the evolving challenges of cyber-enabled financial crime.
For ongoing coverage of cybersecurity news and expert insights, follow us on Google News, Twitter, and LinkedIn.