AudiA6 Crypto Laundering Ring Busted: 11 Countries, $390 Million

A coordinated law enforcement operation across 11 countries on Wednesday, June 11, dismantled AudiA6, a criminal network that laundered more than 336 million euros (around $390 million) in cryptocurrency between 2022 and 2025. The ring served primarily ransomware operators who needed to cash out extortion payments without leaving a blockchain trail. Authorities also shut down Dark2Web, a linked underground marketplace used to advertise illegal services and recruit new participants.

Arrests, Seizures, and Operation Details

Two administrators, a Russian national and a Ukrainian national, were arrested in Georgia on Wednesday. Both now await extradition proceedings to the United States. The EU Agency for Criminal Justice Cooperation (Eurojust) announced the operation's results on Thursday, June 12.

Investigators confiscated over 25 domains and more than 30 servers, seized 80 vehicles, and froze approximately $900,000 in cryptocurrency. The relatively small amount of frozen crypto reflects AudiA6's operating model: the service moved funds through networks of transit accounts rather than holding balances. Blockchain analytics firm Chainalysis traced the full scope of the scheme, reporting that AudiA6 wallets received roughly 10,333 Bitcoin totaling $389 million at the time of each transaction, going back to 2021. Both the regular and dark web versions of the site now display Europol seizure banners.

How AudiA6 Operated

The service offered a "mixer-as-a-service" model: clients sent ransom payments or stolen funds, and AudiA6 processed the transactions in roughly one hour for a 3% to 10% fee. The primary customers were ransomware operators who needed to convert criminal proceeds quickly and sever the blockchain trail connecting payouts to attacks.

To bypass identity checks at crypto platforms, the network relied on thousands of fraudulent accounts built from stolen or purchased identity documents. Eurojust said investigators identified over 6,000 fake KYC records tied to so-called "money mule accounts." Most of the intermediaries moving funds through those accounts were Russian-speaking recruits hired specifically for the role, receiving a percentage of each transaction processed.

Alongside the mixing service, the group ran Dark2Web, a forum where cybercriminals could post ads for illegal services, find technical contractors, and pull in new members. Taking down both platforms at once was a deliberate choice: stripping the network of its operational tool and its recruitment pipeline at the same time.

11 Countries, Two Coordinating Bodies

Agencies from the United States, Australia, France, Poland, Georgia, Iceland, Canada, Germany, Japan, Switzerland, and the United Kingdom took part. Eurojust and Europol handled coordination. The cross-continental composition of the coalition reflects AudiA6's reach: the service's clients operated in dozens of countries and their victims were spread across multiple continents.

Australia's involvement proved critical for building the legal case. The Australian Federal Police established a direct connection between a specific 2024 ransomware attack and AudiA6 wallets, providing concrete evidence linking the service to identifiable victims. That link strengthened the grounds for the US extradition request.

Ransomware Pressure Continues Into 2026

The AudiA6 takedown comes as ransomware attacks remain at elevated levels. Emsisoft recorded attacks in 97 countries during the first quarter of 2026, with the US accounting for 64.7% of all documented victims. The country remains the most targeted market by a wide margin.

Check Point Research reported in May 2026 that the ransomware market is consolidating around fewer dominant operators. The top 10 groups claimed 71% of all Q1 2026 victims. Removing laundering infrastructure like AudiA6 raises the operational cost and risk for ransomware gangs, but investigators acknowledge the pattern: each platform that goes down tends to be replaced by new services, and the cycle continues.