Europol and law enforcement from 11 countries have dismantled the "AudiA6" cryptocurrency mixing service, allegedly used by ransomware actors and other cybercriminals to launder over $380 million between 2022 and 2025. The platform acted as a central money laundering hub, receiving proceeds from cyberattacks, mixing them through complex transactions, and returning "cleaned" funds within an hour, charging a commission of 3-10%. Investigations linked the service to more than 15 international ransomware investigations and large-scale cryptocurrency thefts. The operation relied on thousands of fraudulent exchange accounts opened using stolen or purchased identities, with money mules recruited by Russian-speaking intermediaries. In September 2025, a Ukrainian national was arrested in Poland, leading to the identification of key operators. Two administrators—a Ukrainian and a Russian national—were arrested in Georgia. Authorities seized 25 domains, 80 vehicles and properties, €86,000 in cryptocurrency, and froze €692,000. The suspects face up to 20 years in prison. The U.S. Department of Justice named Ruslan Igorevich Tkachuk and Alexander Vladimirovich Ledenev as senior members, noting that of approximately 10,333 Bitcoin deposited, 393.39 BTC came directly from illicit sources. Additionally, 6,000 KYC records linked to money mules were recovered. Europol highlighted the industrial-scale laundering operation to raise awareness and help platforms block related accounts.

Key facts

• AudiA6 laundered over $380 million for ransomware actors between 2022 and 2025.
• The service used thousands of fake exchange accounts opened with stolen identities.
• Two administrators arrested in Georgia; a Ukrainian national was previously arrested in Poland.
• Authorities seized 25 domains, 80 vehicles, and over €778,000 in cryptocurrency.
• 6,000 KYC records linked to money mules were recovered during the operation.

KeyAudit data perspective