An international law enforcement operation has dismantled AudiA6, a cryptocurrency laundering service that investigators say processed hundreds of millions of euros for cybercriminals, including ransomware operators.
The operation, coordinated by Europol and supported by authorities across Europe, North America, Asia, and Australia, resulted in the arrest of two suspected administrators in Georgia and the seizure of infrastructure used to operate the service. Investigators allege that AudiA6 laundered more than €336 million between 2022 and 2025, making it one of the largest cryptocurrency laundering operations targeted by law enforcement in recent years.
According to Europol, AudiA6 functioned as a central laundering hub for cybercriminals seeking to convert illicit cryptocurrency into funds that were more difficult for authorities to trace. The service allegedly charged commissions ranging from 3% to 10% and promoted itself on underground cybercrime forums.
Authorities arrested a 37-year-old Ukrainian national and a 25-year-old Russian national who are accused of operating both AudiA6 and an associated cybercrime forum known as Dark2Web. U.S. prosecutors identified the suspects as Ruslan Igorevich Tkachuk and Alexander Vladimirovich Ledenev. Both men were taken into custody in Georgia and are facing criminal proceedings linked to alleged money laundering activities.
The coordinated takedown involved searches at three properties, the seizure of 25 domains, the disruption of more than 30 servers, and the blocking of Telegram accounts used by the network. Investigators also froze approximately €692,000 in cryptocurrency and seized an additional €86,000 in digital assets. Authorities further confiscated vehicles and real estate allegedly connected to the operation.
Europol said the investigation linked AudiA6 to more than 15 international investigations involving ransomware attacks and large-scale cryptocurrency theft. Investigators described the operation as an industrial-scale laundering service built around thousands of fraudulent cryptocurrency exchange accounts created using stolen or purchased identities.
U.S. prosecutors allege that more than 10,333 bitcoin, valued at roughly $389 million at the time of the transactions, flowed through AudiA6-controlled wallets after the service launched in 2021. According to court documents, a portion of those funds came directly from ransomware groups, darknet markets, cybercrime services, and other illicit sources.
Investigators say the breakthrough stemmed in part from the September 2025 arrest of a suspect in Poland. Evidence recovered during that investigation reportedly helped authorities identify additional members of the network and locate its administrators.
Both the AudiA6 website and the Dark2Web forum now display law enforcement seizure notices following the operation. Europol said the action was designed to disrupt a financial service that cybercriminals allegedly relied on to conceal the origins of stolen cryptocurrency and ransomware proceeds.