Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs
By Ravie Lakshmanan | June 12, 2026
Authorities across Europe have successfully dismantled AudiA6, a major cryptocurrency laundering platform exploited extensively by ransomware groups and various cybercriminal networks. Europol announced on June 11, 2026, that the disruption of AudiA6 has severed a pivotal financial pipeline that facilitated the laundering of "hundreds of millions" in illegal profits.
AudiA6: A Central Hub for Cybercrime Laundering
Since its inception in 2021, AudiA6 has been estimated to launder over €336 million (approximately $389 million). The platform was heralded as an industrial-scale crypto mixing service, promising clients both speed and anonymity. Cybercriminals utilized AudiA6 to transform ill-gotten cryptocurrency into ostensibly legitimate funds by obscuring transaction trails through sophisticated and complex chains of transactions.
Europol described AudiA6 as a “central hub” for ransomware actors and illicit service providers to cash out stolen digital assets undetected by law enforcement. The platform operated by collecting illicit proceeds and then returning "cleaned" cryptocurrency to customers, often within an hour. Operators charged fees ranging from 3% to 10% for their services, depending on transaction size and complexity.
Dark2Web Forum Connection
The AudiA6 operators are also suspected of controlling Dark2Web, a notorious dark web cybercrime forum. This platform was used for advertising illegal services and enabling connections between threat actors worldwide, further amplifying the reach and impact of AudiA6’s laundering activities.
Coordinated International Enforcement Action
On June 10, 2026, an international law enforcement operation resulted in a series of coordinated actions targeting AudiA6’s infrastructure and operators:
- Arrest of two alleged administrators, Ruslan Igorevich Tkachuk (37) and Alexander Vladimirovich Ledenev (25), reportedly Ukrainian and Russian nationals, in Georgia.
- Execution of three property searches.
- Seizure and takedown of 25 domains and more than 30 servers affiliated with AudiA6 and Dark2Web.
- Confiscation of over 80 vehicles and multiple properties in Georgia.
- Freezing of cryptocurrency assets amounting to approximately €692,000 ($798,000) and seizure of an additional €86,000 ($99,400) in cryptocurrencies.
- Blocking of Telegram accounts used for communication within the laundering network.
- Replacement of AudiA6 and Dark2Web websites on both clear web and dark web with law enforcement seizure banners.
Legal Charges and Potential Sentencing
Following the arrests, the U.S. Department of Justice (DoJ) announced criminal charges against Tkachuk and Ledenev. Both face counts of conspiracy to launder monetary instruments and actual money laundering offenses. If convicted, each could face up to 20 years in prison.
The DoJ highlighted that out of approximately 10,333 bitcoins deposited through the platform, around 393.39 BTC (valued at $19.23 million at the time) were directly traced to darknet markets, ransomware groups, cybercrime services, and other illicit sources. Additional funds were laundered indirectly as well.
Background and Investigation Details
This major disruption is the culmination of investigative efforts initiated by a 2025 enforcement action led by the Polish Police that resulted in the arrest of a Ukrainian national tied to AudiA6’s money laundering activities. This arrest enabled forensic analysis of electronic devices that uncovered further key participants and operational details.
AudiA6 operated with an extensive network of thousands of fraudulent exchange accounts, many established using stolen or purchased identities. Europol identified over 6,000 Know Your Customer (KYC) records connected to money mule accounts, largely involving Russian-speaking intermediaries. These intermediaries played a critical role in moving criminal proceeds through cryptocurrency exchanges, evading traditional anti-money laundering measures.
Domains Used in Money Mule Account Registrations
AudiA6 employed numerous domains under their control to register mule accounts with various crypto exchanges. Some of the identified domains include:
- designli.pictures
- pheontx.eu
- smplfy.in
- sumato-soft.org
- technobrains.dev
- lett.email
- trayo.app
- deliverly.top
- inboxly.top
- postfast.eu
- postino.click
- inboxally.agency
- mailora.eu
- postify.email
- quix.express
- flowcomm.click
- qube.black
- deliverlett.com
- lettermail.eu
Industrial-Scale Crypto Laundering and Broader Impact
Experts have described AudiA6 as a large-scale laundering operation adapting to the evolving cybercrime economy. Its modus operandi involved using thousands of compromised or fraudulent exchange accounts, mule wallets, and encrypted communication channels to stay ahead of regulatory and enforcement scrutiny.
Intelligence reports, including one from Intel 471 in 2021, described AudiA6’s pricing and minimum deposit requirements—charging between 3% and 5.5% fees and requiring a minimum balance of 27 bitcoins.
In late 2025, cybersecurity firm TRM Labs also linked AudiA6 to laundering funds stolen in the 2022 LastPass breach, controlled through Cryptex and AudiA6 platforms.
International Collaboration and Future Outlook
The investigation spanned multiple countries and agencies, including:
- U.S. Secret Service
- IRS Criminal Investigation Division
- Polish Police
- Law enforcement partners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the United Kingdom.
This takedown exposes the growing industrialization of cryptocurrency laundering services that empower ransomware and broader cybercrime ecosystems. Europol noted the increasing use of chain-hopping techniques, decentralized exchanges, and mixer-as-a-service platforms to move illegal cryptocurrency quickly and obscure its origins, posing significant challenges to global anti-money laundering efforts.
Conclusion
The dismantling of AudiA6 marks a significant disruption in the cybercrime infrastructure, cutting off access to a major laundering conduit used by ransomware actors. This enforcement action underscores the continued commitment of international law enforcement agencies to combatting the financial underpinnings of ransomware and cybercrime operations globally.
For more exclusive cybersecurity news and updates, follow us on Google News, Twitter, and LinkedIn.
Tags: Blockchain, Cryptocurrency, Cybercrime, Cybersecurity, Dark Web, Europol, Law Enforcement, Money Laundering, Ransomware