On June 10, 2026, Europol coordinated the takedown of AudiA6, a cryptocurrency laundering service that processed between €336 million and $389 million in illicit funds for ransomware gangs and other criminal operators. Two administrators—Ruslan Igorevich Tkachuk, a Ukrainian national, and Alexander Vladimirovich Ledenev, a Russian national—were arrested in Georgia. During the operation, law enforcement seized 25 domains, more than 30 servers, and over 80 vehicles. The crackdown demonstrates that central nodes of the ransomware economy remain vulnerable to blockchain analysis and undercover infiltration when they masquerade as legitimate infrastructure.
- The June 10, 2026, operation led to the arrests of Tkachuk and Ledenev, the administrators of the AudiA6 laundering service, in Georgia.
- The service laundered at least €336 million (per Europol, 2022-2025) or $389 million / 10,333 BTC (per the DOJ, since 2021) using thousands of fraudulent exchange accounts opened with stolen identities.
- Operators promised an AML risk score below 25% to bypass the anti-fraud systems of legitimate platforms, offering fund "cleaning" in approximately one hour.
- Undercover agents confirmed the service's complicity by explicitly accepting funds declared to be the proceeds of ransomware activity.
"industrial-scale cryptocurrency laundering operation" — Europol on the scale of the AudiA6 service
Laundering Architecture: How AudiA6 Deceived Legitimate Exchanges
AudiA6 was neither a standalone platform nor a decentralized mixer; it was a manual and semi-automated brokerage operation that exploited the same compliant infrastructure used by the legal market. According to Europol, the service controlled thousands of accounts on regulated exchanges, opened using stolen or purchased identities. This base of over 6,000 identified KYC "money mules" constituted the first layer of anonymization.
The second layer combined technical and commercial tactics. The DOJ, citing an unsealed complaint from the Eastern District of Pennsylvania, documents that AudiA6 promised clients an AML risk score of less than 25%. This parameter, internal to platform compliance systems, determines the likelihood of a freeze or a Suspicious Activity Report (SAR). By artificially manipulating this score, the service turned reputable exchanges into "unwitting partners," as described in investigative briefings.
The third layer was speed. Europol measures the "cleaning" cycle at approximately one hour. A chain of rapid cross-chain transactions and conversions dissociated criminal funds from their origin before delayed monitoring systems could correlate alerts. The service explicitly distinguished between "dirty and clean crypto"—terminology cited by the DOJ—and charged commissions between 3% and 10% according to Europol, or up to 5% according to DOJ estimates.
From Poland to Georgia: Closing the Investigative Circle
The June 10, 2026, operation was the result of a long-term investigation. Europol documents a prior arrest on September 15, 2025, in Poland, where a Ukrainian citizen linked to the group was detained and his hardware subjected to forensic examination. That analysis revealed "additional individuals" who allowed investigators to reconstruct the hierarchy and locate the two administrators in Georgia.
The operational timeline spans at least four years. The DOJ indicates activity dating back to 2021, while Europol focuses its estimates on the 2022-2025 period. While the figures are consistent in scale, they diverge: $389 million (approximately 10,333 BTC) for the DOJ versus €336 million for Europol. This discrepancy is explained by slightly different reference periods, EUR/USD fluctuations, and distinct counting methodologies (gross transactions vs. net laundered). Cybernews reports a higher estimate of approximately $890 million, which likely includes volumes associated with linked criminal activities not directly processed by the core service.
Enforcement actions resulted in significant physical and digital seizures: 25 domains are now unreachable or redirect to law enforcement banners, alongside more than 30 servers, over 80 vehicles in Georgia, and multiple real estate properties. Financially, €692,000 (approx. $730,000) was frozen, and an additional €86,000 (approx. $100,000) in cryptocurrency was seized. Furthermore, Telegram accounts were blocked, and sites on both the clearnet and dark web were decommissioned.
The Undercover Trap: When Criminals Documented Their Own Crimes
A distinctive element of the DOJ case is the sting operation. Undercover agents contacted AudiA6, explicitly stating their intent to launder funds linked to ransomware. The operator's response, recorded in the complaint, was: "yes, no problem." This recording eliminates any ambiguity regarding the service's knowing purpose and serves as the strongest evidence for the conspiracy charge.
Another recurring quote in DOJ materials is the service's motto: "cut off your tails." While the tail metaphor refers to blockchain traces, it has become an ironic reality as their own conversations became the very "tails" used by prosecutors. The defendants face a maximum potential sentence of 20 years in prison.
Europol adds broader criminal context: the same operators managed the "Dark2Web" darknet forum, a hub for cybercriminals. This overlap between a laundering service and a community platform reinforces the theory that AudiA6 was an infrastructure intentionally designed as a utility for the ransomware ecosystem, rather than an opportunistic operation.
Why the Fall of a Single Node Exposes the Entire Ecosystem
AudiA6 occupied a structurally critical position. Ransomware groups depend on reliable cash-out services as much as they depend on their own encryptors; without liquidation, extortionists hold only encrypted data and wallets full of traceable evidence. The professionalization observed—fake AML scores, customer service, structured fees, and guaranteed turnaround times—indicated that the market had reached a state of apparent stability. Its forced removal creates an immediate vacuum.
The consequences are threefold. For ransomware victims, the message is that payments do not vanish into a technologically unreachable void; forensic analysis can reconstruct flows even through complex mixers. For the crypto sector, the operation amplifies regulatory pressure on exchanges and Virtual Asset Service Providers (VASPs) to strengthen KYC/AML controls against mule accounts. For law enforcement, the hybrid model—blockchain analysis combined with human infiltration—is a replicable blueprint against other services with similar pseudo-legitimate structures.
The dossier does not specify the immediate operational impact on specific ransomware groups deprived of the service. No infrastructural overlaps have emerged linking specific threat actors to Tkachuk and Ledenev, nor is it clear how much of the laundered funds are recoverable versus irretrievably lost. Furthermore, it remains unknown if residual administrators exist who are capable of rebuilding the infrastructure using the compromised KYC account base.
Questions & Answers
Why do the estimates of laundered volume differ so significantly?
Europol reports €336 million for 2022-2025; the DOJ indicates $389 million (approx. 10,333 BTC) since 2021; Cybernews estimates ~$890 million. These differences likely reflect different time intervals, BTC/EUR/USD fluctuations, and distinct counting methodologies (gross transactional volume vs. net value laundered through the service).
What made AudiA6 different from a standard decentralized mixer?
The documented distinguishing factor was its interaction with regulated exchanges. It was not an autonomous protocol but a system of fraudulent accounts using real identities, managed manually, with commercial guarantees regarding processing times and freeze risks. This model offered higher liquidity than pure mixers but exposed the operators to traditional investigative vulnerabilities.
Are the involved exchanges liable?
The briefing contains no specific charges against identified platforms. Europol describes the exchanges as "unwitting partners." The investigative focus is on the systematic deception of KYC/AML controls, not on institutional complicity by the platforms.
Sources
- https://www.cisa.gov/stopransomware/official-alerts-statements-cisa
- https://cybernews.com/cybercrime/audia6-crypto-washing-shut-down/
- https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline
- https://ambcrypto.com/doj-says-389m-crypto-laundering-network-helped-cybercriminals-evade-exchange-aml-systems/