- Authorities arrested two AudiA6 administrators in Georgia on June 10, making some seizures from the operation.
- The money laundering service processed over EUR 336 million in illegal funds for over three years, using more than 6,000 fake KYC accounts opened with stolen identities to clean cybercriminals’ cryptocurrency within an hour.
- Ransomware gangs heavily relied on AudiA6 to cash out their profits, and the takedown involved 11 countries working through Eurojust and Europol.
Law enforcement agencies from multiple countries have taken down a major cryptocurrency money laundering website. The service, known as ‘AudiA6’, allegedly helped cybercriminals wash more than EUR 336 million (over $389 million) in illegal digital funds between 2022 and 2025. Investigators believe ransomware gangs heavily used the platform to cash out their stolen earnings.
Authorities arrested two suspected administrators in Georgia on June 10. The two men, identified as Ruslan Igorevich Tkachuk (37 years old) and Alexander Vladimirovich Ledenev (25 years old), face charges of conspiracy to launder money.
If convicted, each could spend up to 20 years in a US prison. The criminal group behind AudiA6 also allegedly runs a separate cybercrime forum called ‘Dark2Web’, which serves as a marketplace for connecting criminals worldwide and advertising illegal services.
How the AudiA6 Laundering Machine Operated
The AudiA6 service worked like a high-speed cleaning machine for dirty cryptocurrency. A cybercriminal transferred stolen digital coins to wallets controlled by the AudiA6 group. Within roughly one hour, the criminal received “cleaned” funds back through a complex web of transactions. These transactions made the money’s origin nearly impossible for authorities to trace. The operators charged commissions between 3% and 10% for their services.
Investigators uncovered thousands of fake accounts at the center of this scheme. The group opened these accounts using stolen or purchased identities. Law enforcement identified more than 6,000 Know Your Customer (KYC) records linked to money mule accounts. Many of these accounts are connected to Russian-speaking intermediaries who recruited people specifically to help move criminal money through cryptocurrency exchanges.
The group used both commercial email providers and email addresses linked to domains under their control to register these mule accounts. Authorities have made the domains public so cryptocurrency exchanges can identify and block any accounts tied to this laundering network.
Blockchain analysis revealed the full scale of the operation. Following its launch in 2021, AudiA6 wallets have received approximately 10,333 Bitcoin. At the time of the transactions, the amount was valued at roughly $389 million. About 393 Bitcoin, worth around $19.2 million, came directly from known darknet markets, ransomware organizations, and other illegal sources.
The International Takedown and What Authorities Seized
On June 10, agencies from 11 separate nations conducted the highly coordinated action against the criminal operation. The U.S. Secret Service and IRS-Criminal Investigation worked in conjunction with Polish, French, Georgian, Icelandic, and several other international partners. Europol and Eurojust provided critical coordination and a level of support to the investigation at all stages.
The action day in Georgia produced significant results:
- Two alleged administrators of Ukrainian and Russian nationality went to prison
- Law enforcement searched three properties
- Authorities took down 25 domains and seized more than 30 servers
- Officials seized over 80 vehicles and multiple properties in Georgia
- Investigators froze EUR 692,000 in cryptocurrency, they seized an additional EUR 86,000
The operation was built on an earlier arrest in Poland from September last year. Polish police detained a Ukrainian national involved in the AudiA6 money laundering activities. Forensic examination of electronic devices from the suspect helped investigators identify additional members of the criminal network.
Authorities also replaced the clear web and dark web websites of both AudiA6 and Dark2Web with law enforcement seizure banners. They blocked Telegram accounts, the network used for communication. The seized domains included names like designli.pictures, pheontx.eu, deliverly.top, and over a dozen others.
Why this Takedown Matters for the Fight Against Ransomware
The AudiA6 platform became a central hub for ransomware actors looking to cash out their stolen cryptocurrency. Europol’s analysis linked the criminal organizations supporting the service to over 15 international investigations related to ransomware attacks and huge-scale theft of cryptocurrency.
Ransomware gangs are also using other tactics to pressure victims. One group recently threatened to leak 80,000 financial files from Money Mart on the dark web, showing how ransomware operators diversify their extortion methods.
The European Cybercrime Centre at Europol played an important role in the operation, as experienced experts within the agency were able to track illicit cryptocurrency flows, as well as verify all laundering infrastructure associated with the movement of money across national borders.
Prior to the conclusion of the operation, Europol assisted the relevant national law enforcement authorities with intelligence development to prepare for the final phase of the operation.
This case shows the power of international cooperation to disrupt criminal enterprises that utilize technology. Eurojust coordinated several meetings to prepare for the judicial measures that would be executed within France, Poland, Georgia, and Iceland. The agency helped authorities issue Mutual Legal Assistance requests in multiple jurisdictions.
Eurojust’s US Liaison Desk supported American investigators, while the Polish and French National Desks helped coordinate European actions. The Georgian Liaison Desk collaborated with the Office of the Prosecutor General of Georgia’s Office, the Investigation Department, to prepare for the action day.
The US Attorney’s Office for the Eastern District of Pennsylvania filed the criminal charges. Multiple American agencies participated, including Homeland Security Investigations and the Federal Deposit Insurance Corporation Office of Inspector General.
