International law enforcement agencies have dismantled AudiA6, a cryptocurrency laundering service allegedly used by ransomware groups and other cybercriminals to hide stolen funds.
Authorities say the platform acted as a major crypto laundering hub between 2022 and 2025, helping criminals move and disguise hundreds of millions of euros in digital assets. Europol said AudiA6 was connected to more than 15 international investigations involving ransomware attacks and large-scale cryptocurrency theft.
The service was promoted as a professional cryptocurrency mixing platform. Investigators say it accepted funds linked to criminal activity, moved them through complex transaction routes to hide their origin, and then returned the money to users as supposedly “clean” cryptocurrency. The service reportedly charged a commission for each transaction.
The takedown followed an international investigation involving authorities from several countries, with support from Europol and Eurojust. The operation led to the arrest of two alleged administrators in Georgia, the search of three properties, the seizure of domains and servers, and the freezing or seizure of cryptocurrency assets.
Authorities also blocked Telegram accounts used by the network and replaced the AudiA6 website and the Dark2Web cybercrime forum with law enforcement seizure notices.
The U.S. Department of Justice identified the two alleged senior members as Ruslan Igorevich Tkachuk, a 37-year-old Ukrainian national, and Alexander Vladimirovich Ledenev, a 25-year-old Russian national. Both are currently in the custody of Georgian authorities, while the United States is seeking their extradition.
According to U.S. prosecutors, AudiA6 wallets received about 10,333 bitcoin since the service launched, worth roughly $389.7 million at the time of the transactions. Investigators say some of the funds came directly from known darknet markets, ransomware organizations, cybercrime services and other illicit sources.
Authorities also recovered around 6,000 Know-Your-Customer records linked to money mule accounts. Europol says many of these accounts were created using stolen or purchased identities and were used to open fraudulent exchange accounts.
The case shows how ransomware gangs and cybercriminals continue to rely on crypto laundering services to hide stolen money. It also highlights the growing role of blockchain analysis and international cooperation in tracking illicit cryptocurrency flows.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
If convicted, the two defendants could face up to 20 years in prison.
