Europol Takedown of AudiA6 Crypto Laundering Service Hits Ransomware Gangs

Europol announced on Thursday, June 12, 2026, the coordinated disruption of AudiA6, a cryptocurrency laundering service used by ransomware groups and cybercriminal networks since 2021. The takedown involved arrests, server seizures, and domain takedowns across multiple countries.

The service is estimated to have processed more than 336 million euros, roughly 389 million US dollars, in illicit cryptocurrency since its launch, according to Europol. Europol called AudiA6 a key financial pipeline for washing hundreds of millions in criminal profits.

Two administrators charged in Georgia and the United States

Law enforcement arrested two alleged administrators, Ruslan Igorevich Tkachuk, 37, and Alexander Vladimirovich Ledenev, 25, both of Ukrainian and Russian nationality, in Georgia on June 10, 2026. The US Department of Justice charged them each with one count of conspiracy to launder monetary instruments and one count of sting money laundering. Each faces up to 20 years in prison if convicted.

The operation also included:

• Three property searches in Georgia and seizure of more than 80 vehicles and multiple properties
• Seizure of more than 30 servers and takedown of 25 domains
• Freezing of cryptocurrency assets worth 692,000 euros (798,000 US dollars) and seizure of 86,000 euros (99,400 US dollars) in cryptocurrency
• Blocking Telegram accounts used by the network
• Replacing the AudiA6 and associated Dark2Web dark web forum sites with law enforcement seizure banners

Industrial-scale laundering linked to ransomware and LastPass theft

The DOJ said that of approximately 10,333 bitcoin deposited into AudiA6, about 393.39 BTC, valued at around 19.2 million US dollars at the time of the transactions, came directly from known darknet markets, ransomware organizations, and cybercrime services. The investigation identified more than 6,000 Know Your Customer (KYC) records linked to money mule accounts, many connected to Russian-speaking intermediaries recruited to move funds through exchanges. AudiA6 charged commissions between 3 percent and 10 percent and claimed to launder funds within one hour. A TRM Labs analysis from December 2025 found that funds stolen from the 2022 LastPass hack were routed through Cryptex and AudiA6.

International partnership and next steps

Europol said the disruption was made possible after Polish Police arrested a Ukrainian national in September 2025 for money laundering tied to AudiA6. Forensic analysis of that suspect's devices led to Tkachuk and Ledenev. The investigation involved the US Secret Service, IRS Criminal Investigation, Polish Police, and law enforcement from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the UK. Europol warned that similar industrial-scale laundering services, using fraudulent exchange accounts and mule wallets, remain a threat. The arrested individuals face extradition and trial in the United States.