Law enforcement has dismantled the AudiA6 cryptocurrency service, which investigators say laundered more than $380 million for ransomware actors and other cybercriminals. The operation, announced on Thursday, involved authorities from 11 countries across Europe, America and Asia.
KEY FACTS
- Scale Europol said the service was tied to more than 15 ransomware investigations worldwide.
- Model AudiA6 took illicit crypto, routed it through complex transactions, then returned it cleaned within about an hour.
- Action Authorities arrested two suspects in Georgia, searched three properties and seized 25 domains.
- Funds Officials seized €86,000 in cryptocurrency and froze another €692,000.
The Europol disclosure said investigators found an industrial-scale laundering operation built around thousands of fraudulent exchange accounts opened with stolen or purchased identities. The service operated as a central hub between 2022 and 2025.
Authorities said the platform was marketed as a professional cryptocurrency mixing service, but it accepted cybercrime proceeds, obscured their origin and returned the funds after taking a commission of 3% to 10%. Past reports from Intel471 and blockchain investigator ZachXBT had already flagged AudiA6 for facilitating illegal activity.
The arrests in Georgia followed the September 2025 detention in Poland of a Ukrainian national linked to the service. Forensic review of that suspect’s devices helped investigators identify other people behind the network and led to the seizure of websites used by AudiA6 and the underground forum Dark2Web.
The U.S. Department of Justice said the two men named in the case are charged with laundering cryptocurrency tied to darknet markets, ransomware groups and other illicit sources. It said about 393.39 bitcoin, worth roughly $19.2 million at the time of the transactions, came directly from known criminal sources.
WHY IT MATTERS
The case shows how crypto laundering services can help ransomware groups turn stolen funds into spendable assets at scale. It also highlights how cross-border arrests, exchange records and device forensics can expose networks that rely on fake identities and money mule accounts.