Law enforcement agencies have dismantled the cryptocurrency laundering service known as AudiA6, which authorities say was used by ransomware groups and other cybercriminals to launder more than $380 million in illicit funds.
According to Europol, AudiA6 operated between 2022 and 2025 as a cryptocurrency mixing service that helped criminals hide the origin of stolen funds. The platform allegedly moved money through complex transaction chains before returning it to users for a commission fee.
The international investigation involved authorities from 11 countries and was supported by Europol and Eurojust. Law enforcement agencies traced the operation following the arrest of a Ukrainian suspect in Poland in September 2025. Evidence recovered from the suspect's devices helped identify key members of the network.
Two alleged administrators of AudiA6 were arrested in Georgia. Authorities also searched three properties, seized 25 domains, confiscated 80 vehicles and properties, and froze or seized hundreds of thousands of euros in cryptocurrency. Telegram accounts linked to the network were also blocked.
Blockchain analysis found that more than 10,000 Bitcoin, worth nearly $390 million at the time of the transactions, passed through AudiA6 wallets since the service launched in 2021. Authorities say some of the funds came directly from ransomware groups, darknet markets, and other criminal sources.
US prosecutors have charged Ukrainian national Ruslan Igorevich Tkachuk, 37, and Russian national Alexander Vladimirovich Ledenev, 25, with money laundering offenses. Authorities believe the pair managed both AudiA6 and the Dark2Web cybercrime forum, where illegal services were advertised.
If convicted, both defendants face up to 20 years in prison.