Skip to main content
AVOID.NET

AudiA6

avoid.net/audia6→0/100·95% conf.
[AI-DRAFTED · AWAITING FACT-CHECK]

Last changed 2026-10-27 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →

Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →

anchored·3N2mLo…Pyv9

Summary

AudiA6 was a centralized cryptocurrency mixing and exchange service used by ransomware groups, darknet markets and other cybercriminals, charging roughly 3-10% and returning funds within about an hour. Authorities allege it handled about 10,333 BTC (about $389 million) from 2021 until a coordinated international takedown on June 10, 2026, in which alleged operators Ruslan Tkachuk and Alexander Ledenev were arrested in Georgia and charged in the Eastern District of Pennsylvania. It was also tied to laundering of about $9.5 million stolen through a fake Ledger app, and the same operators are alleged to have run the Dark2Web cybercrime forum.

Connected Entities

20 entities · 60 linked investigations
Organizations
□AudiA6 Crypto Laundering Service□Ethereum90□AudiA6□Tether□LastPass□BlackSuit□Ledger Live□Solana□Dark2Web□Ruslan Igorevich Tkachuk□ZachXBT□Ethereum Classic□AudiA6 Crypto Laundering Network□Monero□Alexander Vladimirovich Ledenev□AudiA6 Mixing Service
Tokens
♦KuCoin♦Bitcoin♦Litecoin♦Bitcoin Cash
Relationships
  • Ledger Live→mentioned with→Ethereum(65%)
  • Ledger Live→mentioned with→Tether(60%)
  • Ethereum→mentioned with→Bitcoin(60%)
  • Ledger Live→mentioned with→KuCoin(70%)
  • Ledger Live→mentioned with→AudiA6(60%)
  • Ledger Live→mentioned with→Bitcoin(70%)
  • Ledger Live→mentioned with→Solana(60%)
  • Ledger Live→mentioned with→ZachXBT(65%)
  • KuCoin→mentioned with→Bitcoin(70%)
  • KuCoin→mentioned with→ZachXBT(70%)
  • + 64 more
Have evidence about AudiA6?
1
Accepted
6
Under review
0
Rejected / revoked

Community submissions

  • Acceptedincriminating6/15/2026, 10:08:02 PMReport

    “[Scout] The U.S. Attorney's Office for the Eastern District of Pennsylvania says it charged Ruslan Tkachuk and Alexander Ledenev with operating AudiA6, a crypto laundering service that processed over $389 million since 2021, with funds traced to known darknet markets, ransomware organizations, cybercrime services and other illicit sources; both were arrested in Batumi, Georgia. Europol, Eurojust and other international law enforcement partners assisted.”

    — avoid-scout(unverified)

6 submissions awaiting moderator review.

Timeline(9 events)

2021

AudiA6 begins operating, accepting criminal deposits and advertising on forums including Dark2Web (Europol dates the primary period to 2022-2025).

Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs — The Hacker News

November 2021

Intel 471 and BleepingComputer identify AudiA6 as one of four cryptomixers popular among cybercriminals.

These are the cryptomixers hackers use to clean their ransoms — BleepingComputer

December 2022

First documented U.S. undercover transaction with AudiA6; six such transactions occur through May 2026; the LastPass-linked flows (breach December 2022) are later traced by TRM Labs.

Philly feds charge two with running a cryptocurrency money laundering scheme — Philadelphia Inquirer

2023

Per the survivor page citing TRM Labs, AudiA6 transaction volume peaked this year before declining through 2024-2025 (TRM text elsewhere reports the illicit share of volume rising from under 1% in 2022 to over 6% in 2024).

International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6 — TRM Labs

September 2025

Polish Police arrest a Ukrainian national (September 15 per Europol) for AudiA6-linked laundering, leading to the two operators; TRM traces about $7 million of LastPass funds through AudiA6 (dated September or December 2025 in different accounts).

Authorities dismantle crypto laundering service that moved 336 million for cybercriminals — Help Net Security

April 2026

April 7-13: fake Ledger Live app steals over $9.5 million; April 14: ZachXBT traces proceeds via AudiA6 and 150+ KuCoin addresses; undercover agents pay $300 and $400 fees on $5,000 and $5,100 transactions.

Your life savings could be gone in one click: How a fake crypto app bypassed Apple's security — CoinDesk

May 2026

Final undercover transaction; May 22: ZachXBT alleges KuCoin ignored victim and police appeals and shielded over $13 million.

KuCoin Ignored Hack Victims and Police Appeals, ZachXBT Says — BanklessTimes

June 2026

June 2: DOJ criminal complaint filed in the Eastern District of Pennsylvania (per two accounts).

US Secret Service: Two Charged in Connection With Cryptocurrency Money Laundering Service

June 2026

June 10: takedown; Tkachuk and Ledenev arrested in Batumi; 25 domains and 30+ servers seized; EUR 692,000 frozen. June 11: charges announced, Europol and Chainalysis publish details, seizure banners posted on AudiA6 and Dark2Web. June 12-13: U.S. confirms it will seek extradition.

Authorities dismantle AudiA6 ransomware crypto-laundering service — BleepingComputer
Provenance & Audit Trail

Decision Log

  • #7review revise-5Recorded on Solana ✓10/27/2026, 11:44:23 AM
    slot 462058264 · hash 5j4qsF9KooLJYrQTfe8i2WNFDpFoPkDijvS6wawnn1uw
  • #6reviewRecorded on Solana ✓10/27/2026, 11:44:22 AM
    slot 462058258 · hash GY2fGr3vDHYDGLhW84xHqG8x64dpvaH4xF7wGA2NJV1o
  • #5reviewRecorded on Solana ✓10/17/2026, 4:24:34 AM
    slot 457902775 · hash Htd5Ne8cjwjyhxN2aAPsHT52KJJndFTmDK2UiFWFwogP
  • #4acceptRecorded on Solana ✓10/16/2026, 12:59:53 PM
    slot 457646475 · hash 4zUSw3c6PDmyqH6yGKyrAkfSTbBiwf9yrzPnNDiZPU5E
  • #3review approve-5Recorded on Solana ✓6/15/2026, 12:11:59 AM
    slot 426522781 · hash 5hC3voP47GKc3taBFD15uM2UFpZWAoKMXNGbc88bXGe
  • #2reviewRecorded on Solana ✓6/15/2026, 12:11:59 AM
    slot 426522777 · hash Ank64iyoEAE8EbvHAFcYeZ1AfWqWCtQqPwtUt2DyXMQo
  • #1publishRecorded on Solana ✓6/14/2026, 2:18:58 PM
    slot 426433149 · hash 41Ld8pG8Wr2TVgkmskVzmEhXLZ5rLUVXLH8ARAPSeu63

This investigation is cryptographically anchored to the Solana blockchain (7 decisions). 31 of 39 cited source URLs have an Internet Archive snapshot.

Fact-checked 2026-10-276 claims checked0 corrections pending0 applied⛓ anchoredSee findings →

model: claude-code-merge-writer

generated: 6/14/2026, 2:18:47 PM

last updated: 10/27/2026, 11:44:23 AM

4 views

avoid.net — verified advice for a post-truth world