An international law enforcement coalition dismantled the “AudiA6” cryptocurrency laundering service on Wednesday, arresting two senior operators in the Republic of Georgia. The global operation targeted a financial network that allegedly laundered 10,333 Bitcoin—valued at roughly $389 million at the time of the transactions—for ransomware gangs and darknet cybercriminals since 2021.
The takedown arrives amid escalating international crackdowns on the financial infrastructure supporting industrial-scale ransomware operations. Investigators from the US Department of Justice, Europol, Eurojust, and the Secret Service collaborated to seize servers across the US, Iceland, Germany, and France.
The Coordinated Takedown
Authorities apprehended Ruslan Igorevich Tkachuk, 37, and Alexander Vladimirovich Ledenev, 25, in Batumi. Both men face charges of conspiracy to launder monetary instruments, according to the US Department of Justice. During the coordinated raids, officials froze over €692,000 in digital assets, blocked associated Telegram accounts, and replaced the group’s websites with law enforcement seizure notices.
The AudiA6 network utilized thousands of fraudulent exchange accounts and money mule wallets registered with stolen identities to process illicit funds. This system allowed criminals to cash out stolen funds within an hour of transfer while evading standard Know Your Customer controls. The operation gained critical momentum following the September 2025 arrest of a co-conspirator in Poland, whose seized electronic devices helped map the broader network, as outlined in a detailed Europol breakdown of the international infrastructure.
Dark2Web Operations
Alongside the laundering pipeline, the suspects also operated the “Dark2Web” cybercrime forum. On this platform, they explicitly advertised their money laundering services, charging commissions between 5% and 10% to obscure the origins of digital assets. The coordinated judicial effort established the Dark2Web forum link to the broader laundering scheme.
How AudiA6’s Removal Disrupts the Global Cryptomixer Market
Prior to Wednesday’s arrests, threat intelligence analysts at Intel 471 tracked AudiA6 as one of the four most prominent cryptomixing services operating in the cybercrime ecosystem. The service operated directly alongside rival illicit platforms like Absolutio, Blender, and Mix-btc.
The elimination of AudiA6 removes a primary liquidity pipeline that ransomware operators relied upon to convert extortion payments into usable fiat currency.