European authorities have delivered a substantial blow to the cybercrime ecosystem with the disruption of **AudiA6**, a sophisticated cryptocurrency laundering service. **Europol** announced that the operation effectively severed a "key financial pipeline" that had been used to wash hundreds of millions in illicit profits. Since its inception in 2021, **AudiA6** is estimated to have laundered more than €336 million (approximately $389 million). The platform had become a central hub for ransomware actors and other cybercriminals seeking to cash out stolen digital assets while meticulously hiding the money trail from law enforcement agencies. ### Dark2Web Connection Investigators suspect that the operators of **AudiA6** also managed **Dark2Web**, a dark web cybercrime forum. This forum served as a marketplace where cybercriminals advertised illicit services and forged connections with other threat actors globally.  ### Coordinated Enforcement Action The operation, executed on June 10, 2026, involved a series of coordinated actions across multiple jurisdictions: * Two alleged administrators, identified as Ukrainian and Russian nationals, were arrested in Georgia. * Three properties were searched. * 25 domains were taken down, and over 30 servers were seized. * More than 80 vehicles and multiple properties in Georgia were seized. * Cryptocurrency assets worth €692,000 ($798,000) were frozen, and an additional €86,000 ($99,400) in cryptocurrency was seized. * Telegram accounts used by the network were blocked. * Both the clear web and dark web websites for **AudiA6** and **Dark2Web** were replaced with law enforcement seizure banners. ### U.S. Charges and Indictments In tandem with European efforts, the **U.S. Department of Justice (DoJ)** announced charges against the two arrested individuals: **Ruslan Igorevich Tkachuk**, 37, and **Alexander Vladimirovich Ledenev**, 25. They face one count of conspiracy to launder monetary instruments and one count of sting money laundering. If convicted, both individuals could face a maximum sentence of 20 years in prison. The **DoJ** stated that out of approximately 10,333 Bitcoin deposited into **AudiA6**, about 393.39 BTC (valued at around $19,234,331 at the time of transactions) were directly received from known darknet markets, ransomware organizations, cybercrime services, and other illicit sources. Additional funds were deposited indirectly from illicit sources into **AudiA6** wallets. ### Investigative Breakthroughs **Europol** indicated that the breakthrough in this case stemmed from an earlier enforcement action by the Polish Police in September 2025. This led to the arrest of a Ukrainian national involved in money laundering activities connected to the **AudiA6** group. Forensic examination of seized electronic devices from this suspect allowed authorities to identify additional individuals linked to the operation. ### Industrial-Scale Laundering **AudiA6** operated as an industrial-scale cryptocurrency laundering service, leveraging thousands of fraudulent exchange accounts opened using stolen or purchased identities. The criminal service has been implicated in over 15 investigations worldwide concerning ransomware attacks and large-scale cryptocurrency theft. Prior to its takedown, **AudiA6** was marketed as a mixing service that promised anonymity and speed. Customers could transfer their illicit proceeds to wallets controlled by the group and receive "cleaned" funds within an hour through a "complex chain of transactions" designed to obscure the original source of the money. Operators charged commissions ranging from 3 to 10 percent, with transactions often conducted over private messaging platforms. ### Money Mules and Obfuscation Techniques During the investigation, over 6,000 Know Your Customer (KYC) records linked to money mule accounts were identified. Many of these accounts were connected to Russian-speaking intermediaries specifically recruited to facilitate the movement of criminal proceeds through various cryptocurrency exchanges. **AudiA6** also employed a mix of commercial email providers and email addresses linked to domains under their control to register these money mule accounts with cryptocurrency exchanges. The domains included: * designli.pictures * pheontx.eu * smplfy.in * sumato-soft.org * technobrains.dev * lett.email * trayo.app * deliverly.top * inboxly.top * postfast.eu * postino.click * inboxally.agency * mailora.eu * postify.email * quix.express * flowcomm.click * qube.black * deliverlett.com * lettermail.eu Previous reports from security firms like **Intel 471** in November 2021 noted that **AudiA6** required a minimum balance of 27 Bitcoin and charged a service fee between 3% and 5.5%. More recently, a **TRM Labs** analysis in December 2025 found that funds stolen from the 2022 **LastPass** hack were routed through **Cryptex** and **AudiA6**. This extensive investigation involved the **United States Secret Service**, **IRS Criminal Investigation**, Polish Police, and law enforcement partners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the U.K. ### The Evolving Threat Landscape The findings underscore the growing prevalence of industrial-scale cryptocurrency laundering services that underpin the cybercrime economy. These operations rely on fraudulent exchange accounts, mule wallets, and privacy-focused tools to obfuscate money trails and bypass anti-money laundering controls. **Europol** warned that "Ransomware groups and cybercriminal networks are increasingly relying on chain-hopping, decentralised exchanges and 'mixer-as-a-service' platforms to move illicit cryptocurrency across multiple blockchains within minutes, helping criminal profits disappear into the digital underground."