Global Authorities Dismantle "AudiA6," a Major Cryptocurrency Laundering Network Linked to Ransomware Groups
In a coordinated international operation, law enforcement agencies have dismantled AudiA6, a sophisticated cryptocurrency laundering service that processed over €336 million between 2022 and 2025. The platform, a critical financial hub for ransomware operators and cybercriminal networks, enabled threat actors to obscure illicit funds through rapid, complex transaction chains while evading detection.
The takedown, executed on June 10, involved the U.S. Secret Service, IRS Criminal Investigation, Polish law enforcement, Europol, and Eurojust, alongside other global partners. Authorities arrested two suspected administrators one Ukrainian and one Russian in Georgia, seized 30+ servers, took down 25 domains, and froze cryptocurrency assets worth hundreds of thousands of euros. Additional assets, including vehicles and properties, were confiscated, and associated Telegram accounts and dark web platforms were shut down, replaced with official seizure notices.
AudiA6 operated as a professional laundering service, advertised on underground forums, allowing cybercriminals including ransomware affiliates to transfer stolen cryptocurrency and receive "cleaned" funds within an hour. The service charged 3–10% commissions and relied on a network of 6,000+ fraudulent accounts, many tied to stolen identities and managed by Russian-speaking intermediaries. These accounts were used to move funds across exchanges, often bypassing compliance checks through commercial email services and custom domains.
Investigators also linked AudiA6 to the Dark2Web cybercrime forum, a marketplace for illicit services and a hub for threat actor coordination. Europol connected the platform to 15+ ransomware and cryptocurrency theft investigations, highlighting its role as a central enabler in the cybercrime ecosystem. The operation aligns with Europol’s findings on the growing professionalization of cryptocurrency laundering, where services increasingly use chain-hopping, decentralized exchanges, and mixers to evade anti-money laundering controls.
While the takedown disrupts a key financial pipeline for ransomware groups, authorities note that similar services continue to evolve, sustaining the global cybercrime economy.
Source: https://cybersecuritynews.com/authorities-dismantle-audia6-services/
Europol cybersecurity rating report: https://www.rankiteo.com/company/europol
"id": "EUR1781267562",
"linkid": "europol",
"type": "Cyber Attack",
"date": "6/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Ransomware operators, '
'cybercriminal networks',
'industry': 'Cybercrime',
'location': 'Global (servers and domains seized '
'internationally)',
'name': 'AudiA6',
'type': 'Cryptocurrency laundering service'},
{'customers_affected': 'Threat actors, ransomware '
'affiliates',
'industry': 'Cybercrime',
'name': 'Dark2Web cybercrime forum',
'type': 'Underground marketplace'}],
'attack_vector': 'Underground forums, fraudulent cryptocurrency accounts, '
'chain-hopping, decentralized exchanges, mixers',
'data_breach': {'personally_identifiable_information': 'Stolen identities '
'used for fraudulent '
'accounts'},
'date_publicly_disclosed': '2025-06-10',
'date_resolved': '2025-06-10',
'description': 'In a coordinated international operation, law enforcement '
'agencies have dismantled AudiA6, a sophisticated '
'cryptocurrency laundering service that processed over €336 '
'million between 2022 and 2025. The platform enabled threat '
'actors to obscure illicit funds through rapid, complex '
'transaction chains while evading detection. The takedown '
'involved the U.S. Secret Service, IRS Criminal Investigation, '
'Polish law enforcement, Europol, and Eurojust, resulting in '
'arrests, server seizures, domain takedowns, and asset '
'freezes.',
'impact': {'financial_loss': '€336 million processed (2022–2025)',
'identity_theft_risk': 'Fraudulent accounts tied to stolen '
'identities',
'operational_impact': 'Disruption of cryptocurrency laundering '
'operations for ransomware groups',
'systems_affected': '30+ servers, 25 domains, fraudulent '
'cryptocurrency accounts'},
'investigation_status': 'Ongoing (disruption achieved, but similar services '
'continue to evolve)',
'lessons_learned': 'Growing professionalization of cryptocurrency laundering '
'services, use of chain-hopping and mixers to evade '
'detection, critical role of international law enforcement '
'coordination in disrupting cybercrime financial '
'pipelines.',
'motivation': 'Financial gain, money laundering, evasion of anti-money '
'laundering controls',
'post_incident_analysis': {'corrective_actions': 'International law '
'enforcement coordination, '
'asset seizures, domain '
'takedowns, arrests of key '
'administrators',
'root_causes': 'Professionalization of '
'cryptocurrency laundering, use of '
'fraudulent accounts and stolen '
'identities, reliance on '
'decentralized exchanges and mixers '
'to evade AML controls'},
'recommendations': 'Enhanced monitoring of cryptocurrency transactions, '
'stricter compliance checks for exchanges, international '
'collaboration to track and dismantle laundering networks, '
'public awareness of stolen identity risks in cybercrime.',
'references': [{'source': 'Europol'},
{'source': 'U.S. Secret Service'},
{'source': 'IRS Criminal Investigation'}],
'regulatory_compliance': {'legal_actions': 'Arrests, asset seizures, domain '
'takedowns',
'regulations_violated': 'Anti-money laundering '
'(AML) laws'},
'response': {'containment_measures': 'Arrests of administrators, seizure of '
'30+ servers, takedown of 25 domains, '
'freezing of cryptocurrency assets, '
'shutdown of Telegram accounts and dark '
'web platforms',
'law_enforcement_notified': 'Yes',
'remediation_measures': 'Asset confiscation (vehicles, '
'properties), replacement of dark web '
'platforms with seizure notices',
'third_party_assistance': 'U.S. Secret Service, IRS Criminal '
'Investigation, Polish law '
'enforcement, Europol, Eurojust'},
'threat_actor': ['Ransomware groups',
'Cybercriminal networks',
'Russian-speaking intermediaries'],
'title': "Global Authorities Dismantle 'AudiA6,' a Major Cryptocurrency "
'Laundering Network Linked to Ransomware Groups',
'type': 'Cryptocurrency Laundering'}