Europol Dismantles AudiA6 Crypto Laundering Service Used by Ransomware Gangs

Europol, in coordination with international law enforcement, has disrupted AudiA6, a cryptocurrency laundering service that facilitated the washing of over €336 million (~$389 million) in illicit profits since 2021. The service was a critical financial pipeline for ransomware gangs and cybercriminal networks.

On June 10, 2026, coordinated actions led to the arrest of two alleged administrators—Ruslan Igorevich Tkachuk, 37, and Alexander Vladimirovich Ledenev, 25—of Ukrainian and Russian nationality in Georgia. The operation included three property searches, takedown of 25 domains, seizure of more than 30 servers, over 80 vehicles, multiple properties, and cryptocurrency assets worth €692,000 ($798,000). Telegram accounts used by the network were blocked, and the websites of AudiA6 and the associated dark web forum Dark2Web were replaced with law enforcement seizure banners.

The U.S. Department of Justice (DoJ) announced charges against the two individuals for conspiracy to launder monetary instruments and sting money laundering, each facing up to 20 years in prison. AudiA6 operated as an industrial-scale mixing service, using thousands of fraudulent exchange accounts opened with stolen identities. It charged commissions between 3% and 10% and processed transactions through a complex chain to conceal fund origins. Over 6,000 Know Your Customer (KYC) records linked to money mule accounts were identified, many connected to Russian-speaking intermediaries.

The investigation was led by the United States Secret Service and IRS Criminal Investigation, with support from Polish Police and law enforcement partners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the U.K. This disruption highlights the growing reliance of cybercriminals on chain-hopping, decentralized exchanges, and mixer-as-a-service platforms to launder cryptocurrency.