Ethical Hacking News
Europol has disrupted AudiA6, a cryptocurrency laundering service used by ransomware gangs and cybercriminal networks. The operation resulted in the arrest of two alleged administrators, seizure of servers and assets worth millions, and shutdown of related domains. This significant blow to the cybercrime economy highlights the importance of international cooperation in combating illicit activities.
AudiaA6, an industrial-scale cryptocurrency laundering operation, was disrupted by Europol and law enforcement agencies worldwide.The service was launched in 2021 and relied on thousands of fraudulent exchange accounts to launder hundreds of millions in illicit profits.Two alleged administrators were arrested in Georgia, along with multiple individuals linked to the operation.Cryptocurrency assets worth €692,000 ($798,000) were frozen, and €86,000 ($99,400) were seized.The disruption of AudiA6 serves as a significant blow to the rise of industrial-scale cryptocurrency laundering services.
In a significant operation conducted on June 10, 2026, Europol in collaboration with law enforcement agencies from multiple countries worldwide successfully disrupted the AudiA6 crypto laundering service. This critical disruption cuts off a key financial pipeline used by ransomware gangs and cybercriminal networks to launder hundreds of millions in illicit profits.
The AudiA6 service was launched in 2021 and has been described as an industrial-scale cryptocurrency laundering operation that relied on thousands of fraudulent exchange accounts opened using stolen or purchased identities. The criminal service was marketed as a cryptocurrency mixing service guaranteeing anonymity and speed, allowing customers to transfer their ill-gotten proceeds to wallets controlled by the group and receive "cleaned" funds in return within an hour through a complex chain of transactions designed to conceal the origin of the funds.
The AudiA6 service operated on a business model where operators charged commissions ranging from 3 percent to 10 percent, with more than 6,000 Know Your Customer (KYC) records linked to money mule accounts identified during the investigation. These mule accounts were connected to Russian-speaking intermediaries recruited specifically to help move criminal proceeds through cryptocurrency exchanges.
In order to carry out its illicit activities, AudiA6 utilized both commercial email providers and email addresses linked to domains under their control to register money mule accounts with various cryptocurrency exchanges. The names of these domains included designli.pictures, pheontx.eu, smplfy.in, sumato-soft.org, technobrains.dev, lett.email, trayo.app, deliverly.top, inboxly.top, postfast.eu, postino.click, inboxally.agency, mailora.eu, postify.email, quix.express, flowcomm.click, qube.black, deliverlett.com, lettermail.eu, and many others.
The AudiA6 service was also linked to a dark web cybercrime forum known as Dark2Web, where cybercriminals advertised illicit services and connected with other threat actors across the world. This connection further highlights the significant role that AudiA6 played in facilitating the operations of ransomware gangs and cybercriminal networks.
Following an earlier enforcement action carried out by the Polish Police that led to the arrest of an Ukrainian national in September 2025 for their alleged involvement in money laundering activities connected to the AudiA6 group, Europol was able to initiate a forensic examination of the seized electronic devices belonging to the suspect. This led to the identification of additional individuals linked to the operation.
As part of the coordinated actions carried out by law enforcement agencies on June 10, 2026, two alleged administrators of Ukrainian and Russian nationality were arrested in Georgia. Three property searches took place, with the takedown of 25 domains and seizure of more than 30 servers. Additionally, over 80 vehicles and multiple properties in Georgia were seized.
The authorities also froze cryptocurrency assets worth €692,000 ($798,000) and seized €86,000 ($99,400) in cryptocurrency. Furthermore, Telegram accounts used by the network were blocked, and the clear web and dark web websites of AudiA6 and Dark2Web were replaced with a law enforcement seizure banner.
In tandem with Europol's operation, the U.S. Department of Justice (DoJ) announced charges against the two arrested individuals, Ruslan Igorevich Tkachuk, 37, and Alexander Vladimirovich Ledenev, 25. The DoJ accused them of one count of conspiracy to launder monetary instruments and one count of sting money laundering. If convicted, both defendants face a maximum possible sentence of 20 years in prison.
According to the DoJ, out of approximately 10,333 bitcoin deposited into AudiA6, approximately 393.39 BTC (valued at around $19,234,331 at the time of the transactions) were received directly from known darknet markets, ransomware organizations, cybercrime services, and other illicit sources.
The disruption of AudiA6 serves as a significant blow to the rise of industrial-scale cryptocurrency laundering services that enable the cybercrime economy. The finding highlights the use of fraudulent exchange accounts, mule wallets, and privacy-focused tools designed to cover up the money trail and bypass anti-money laundering controls.
Europol's crackdown illustrates the increasing reliance of ransomware groups and cybercriminal networks on chain-hopping, decentralized exchanges, and 'mixer-as-a-service' platforms to move illicit cryptocurrency across multiple blockchains within minutes. This method allows criminal profits to disappear into the digital underground.
The AudiA6 service has been linked to more than 15 investigations worldwide related to ransomware attacks and large-scale cryptocurrency theft. The investigation was carried out by the United States Secret Service and the IRS Criminal Investigation, along with law enforcement partners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Switzerland, and the U.K.
The disruption of AudiA6 is a testament to the efforts of law enforcement agencies worldwide in combating cybercrime and ransomware gangs. The coordinated actions carried out on June 10, 2026, have undoubtedly made a significant impact on the illicit operations of these criminal networks.
Related Information:
https://www.ethicalhackingnews.com/articles/AudiA6-Crypto-Laundering-Service-Disrupted-by-Europol-A-Decisive-Blow-to-Ransomware-Gangs-and-Cybercrime-Networks-ehn.shtml
https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html
Published: Fri Jun 12 03:55:30 2026 by llama3.2 3B Q4_K_M
