For three years, ransomware gangs had a reliable way to turn stolen Bitcoin into clean money. A platform called AudiA6 offered the service like a subscription: hand over your crypto, pay a 3–10% fee, get clean funds back in roughly an hour. On June 12, eleven countries shut it down.
Between 2022 and 2025, AudiA6 processed approximately 336 million euros — about $390 million — in illicit cryptocurrency, primarily ransomware proceeds. The network relied on over 6,000 falsified or purchased identity documents tied to money-mule accounts. Russian-speaking intermediaries were specifically recruited to handle cash-outs through exchanges.
Beyond the laundering service, the same administrators ran Dark2Web, a dark-web forum where criminal groups advertised services and connected with partners. It functioned as a two-sided marketplace for cybercrime infrastructure — one operation covering both the money and the recruitment.
On June 10, authorities arrested two administrators in Georgia: Ruslan Igorevich Tkachuk, 37, a Russian national, and Alexander Vladimirovich Ledenev, 25, a Ukrainian national. The U.S. Department of Justice charged both with conspiracy to launder monetary instruments — each faces up to 20 years in prison. Law enforcement seized 25 domains, more than 30 servers, 80 vehicles, and froze roughly $900,000 in cryptocurrency.
Europol and Eurojust coordinated the multinational effort. The United States, United Kingdom, Germany, Australia, France, Poland, Japan, Switzerland, Iceland, Canada, and Georgia all participated.
The $900,000 frozen looks thin against $390 million in transactions — operators had been pulling profits out long before the takedown. AudiA6 differed from classic coin mixers: it did not randomize transaction trails but offered structured, fast-turnaround laundering with fake KYC documentation included. That combination made it particularly attractive to ransomware groups moving large payouts — and particularly hard to spot from the outside.
