← AudiA6 Crypto Laundering Networkreviewed 2026-09-06 · 43 claims checked
Fact-check findings
What an automated fact-checker found when it re-read AudiA6 Crypto Laundering Network against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
5 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #1[disputed][awaiting moderator]in the summary
“operating from 2021 through 2025”
reviewerAudiA6 allegedly operated from 2021 through 2025The summary states operations ran 'through 2025' but the same summary and every section describe AudiA6 as active and dismantled on June 10, 2026, and TRM Labs traces funds moving through it as recently as September 2025. The stated end year is internally inconsistent with the rest of the page.Proposed correction (not yet applied)operating from 2021 through 2026 - #29[disputed][awaiting moderator]in section: International Law Enforcement Operation
“law enforcement agencies from 11 additional countries: Australia, Canada, France, Georgia, Germany, Iceland, Japan, Poland, Switzerland, and the United Kingdom”
reviewerThe takedown was coordinated by the Secret Service and IRS-CI with Europol, Eurojust, and law enforcement from 11 additional countriesThe page's own list contains exactly 10 countries, not 11, and matches the 10 non-US countries named by the Secret Service and Europol. The '11' appears to be a miscount.Proposed correction (not yet applied)law enforcement agencies from 10 additional countries: Australia, Canada, France, Georgia, Germany, Iceland, Japan, Poland, Switzerland, and the United Kingdom - #31[disputed][awaiting moderator]in section: International Law Enforcement Operation
“An additional EUR 692,000 in cryptocurrency was frozen and EUR 86,000 in cash was seized.”
reviewerAn additional EUR 692,000 in cryptocurrency was frozen and EUR 86,000 in cash was seizedThe cited regulatory source describes both the EUR 692,000 and EUR 86,000 amounts as cryptocurrency; the page mischaracterizes the second figure as cash.Proposed correction (not yet applied)An additional EUR 692,000 in cryptocurrency was frozen and EUR 86,000 in cryptocurrency was seized. - #37[disputed][awaiting moderator]in the timeline
“AudiA6 begins receiving illicit funds traceable to the 2022 LastPass data breach, according to later TRM Labs on-chain analysis.”
reviewerTimeline: AudiA6 begins receiving illicit funds traceable to the 2022 LastPass data breachThis entry conflates the year of the LastPass breach (2022) with the timing of funds reaching AudiA6. Per the cited TRM Labs source, the identified fund movement occurred in September 2025, not starting in 2022; this entry duplicates and conflicts with the separate, correctly-dated December 2025 timeline entry about TRM's analysis.Proposed correction (not yet applied)A September 2025 wave of funds stolen in the 2022 LastPass data breach reaches AudiA6, according to later TRM Labs on-chain analysis. - #38[disputed][awaiting moderator]in the timeline
“2022-01-01”
reviewerTimeline: the 2022-01-01 date field for the LastPass entry is itself inaccurateThe stored date value (2022-01-01, i.e. year of the LastPass breach) does not match when the illicit funds actually reached AudiA6 (September 2025) per the cited source; it should be corrected to reflect the fund-movement date, not the original breach year.Proposed correction (not yet applied)2025-09-01
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #36[partially supported][awaiting moderator]in the timeline
“AudiA6 cryptocurrency laundering service alleged to have launched operations, according to DOJ and on-chain analytics.”
reviewerTimeline: AudiA6 alleged to have launched operations in 2021The 2021 date is well supported by the majority of primary and secondary sources (DOJ, Secret Service, TRM Labs, most press), but a Europol release gives a conflicting 2022 start year. Not corrected here because the weight of evidence favors 2021, but the conflict should be noted.
confirmed
37 claimsThe cited evidence supports the claim as written.
- #2[confirmed][no action needed]in the summary
“accused of processing approximately $389.7 million (EUR 336 million) in illicit funds for ransomware gangs and other cybercriminals”
reviewerAudiA6 processed approximately $389.7 million (EUR 336 million) in illicit fundsFigure matches DOJ and Secret Service press releases and is corroborated by TRM Labs and multiple news outlets. - #3[confirmed][no action needed]in the summary
“The service also administered the Dark2Web dark web cybercrime forum.”
reviewerAudiA6 also administered the Dark2Web dark web cybercrime forumConfirmed by multiple contemporaneous reports, though attribution is alleged rather than adjudicated, which the page acknowledges elsewhere. - #4[confirmed][no action needed]in the summary
“A US-led international law enforcement operation dismantled AudiA6's infrastructure on June 10, 2026”
reviewerA US-led international law enforcement operation dismantled AudiA6's infrastructure on June 10, 2026Date corroborated by Help Net Security and FDIC OIG republication of the Europol release. - #5[confirmed][no action needed]in the summary
“two alleged operators were arrested in Batumi, Georgia and charged by the US Department of Justice”
reviewerTwo alleged operators were arrested in Batumi, Georgia and charged by the US Department of JusticeConfirmed directly by the DOJ press release. - #6[confirmed][no action needed]in section: Overview and Alleged Operations
“within approximately one hour, returned laundered funds to customers after routing them through a complex chain of transactions designed to obscure their origin”
reviewerLaundered funds returned to customers within approximately one hourConsistent across Secret Service, DOJ, Europol-sourced and independent reporting. - #7[confirmed][no action needed]in section: Overview and Alleged Operations
“The service charged fees of up to 5% per transaction according to the DOJ and Secret Service”
reviewerThe service charged fees of up to 5% per transaction according to the DOJ and Secret ServiceDirectly confirmed. - #8[confirmed][no action needed]in section: Overview and Alleged Operations
“reporting from Europol and other outlets placed the fee range between 3% and 10%”
reviewerReporting from Europol and other outlets placed the fee range between 3% and 10%Confirmed by Hacker News and Help Net Security, both attributing the figure to Europol. - #9[confirmed][no action needed]in section: Overview and Alleged Operations
“The service allegedly processed approximately 10,333 Bitcoin since its launch in 2021, with a total estimated value at the time of transactions of approximately $389.7 million (EUR 336 million).”
reviewerAudiA6 processed approximately 10,333 Bitcoin since its launch in 2021, worth ~$389.7M / EUR 336MNote: a Europol release republished via FDIC OIG separately describes the laundering window as 'between 2022 and 2025,' conflicting with the 2021 launch date used consistently elsewhere (DOJ, TRM Labs, most press). This is flagged separately as a minor cross-source discrepancy on the 2021 timeline entry. - #10[confirmed][no action needed]in section: Overview and Alleged Operations
“Approximately 80% of traced illicit exposure — roughly $63 million of $79 million in directly attributable flows — was tied to ransomware proceeds, according to blockchain analytics firm TRM Labs.”
reviewerApproximately 80% of traced illicit exposure ($63M of $79M) was tied to ransomware proceeds, per TRM LabsFigures match TRM Labs' published blog exactly. - #11[confirmed][no action needed]in section: Alleged Operators and Criminal Charges
“Ruslan Igorevich Tkachuk, 37, a Ukrainian national, and Alexander Vladimirovich Ledenev, 25, a Russian national, were both residing in Batumi, Georgia at the time of their arrest.”
reviewerNames, ages and nationalities of the two defendantsConfirmed by DOJ and corroborated by all secondary reporting. - #12[confirmed][no action needed]in section: Alleged Operators and Criminal Charges
“Both were arrested on June 10, 2026, and are described by the DOJ as having served as senior members managing the operation.”
reviewerBoth were arrested on June 10, 2026 and described by the DOJ as senior members managing the operationThe DOJ criminal complaint reportedly alleges Tkachuk and Ledenev are 'senior members of the AudiA6 organization, who manage' the service and Dark2Web -- closely matches the page's paraphrase. - #13[confirmed][no action needed]in section: Alleged Operators and Criminal Charges
“Each defendant faces one count of conspiracy to launder monetary instruments and one count of sting money laundering, with a maximum sentence of 20 years imprisonment per count.”
reviewerEach defendant faces one count of conspiracy to launder monetary instruments and one count of sting money laundering, max 20 years per countCharge names and sentencing exposure confirmed against primary source language. - #14[confirmed][no action needed]in section: Alleged Operators and Criminal Charges
“As of the date of this report, Tkachuk and Ledenev are in the custody of Georgian authorities. The US Attorney's Office for the Eastern District of Pennsylvania has stated it will seek their extradition to the United States. These are criminal charges; no conviction or adjudicated finding of guilt has been entered.”
reviewerTkachuk and Ledenev are in custody of Georgian authorities and the US will seek extradition; no conviction enteredStatus still accurate as of a September 2026 search; no reported update on extradition. - #15[confirmed][no action needed]in section: Laundering Methodology
“AudiA6 operated using a network of more than 6,000 Know Your Customer (KYC)-verified money mule accounts opened with stolen or purchased identities at centralized cryptocurrency exchanges.”
reviewerAudiA6 used a network of more than 6,000 KYC-verified money mule accounts opened with stolen or purchased identitiesConfirmed. - #16[confirmed][no action needed]in section: Laundering Methodology
“Criminal customers contacted AudiA6 operators through private messaging applications.”
reviewerCriminal customers contacted AudiA6 operators through private messaging applicationsConfirmed by secondary reporting; consistent with Telegram accounts being blocked in the takedown. - #17[confirmed][no action needed]in section: Laundering Methodology
“Once funds were deposited, they were passed through multiple wallets and exchange accounts — many linked to Russian-speaking intermediaries — to obscure the chain of custody.”
reviewerFunds passed through multiple wallets and exchange accounts, many linked to Russian-speaking intermediariesConfirmed by independent reporting. - #18[confirmed][no action needed]in section: Laundering Methodology
“According to the DOJ, the service explicitly marketed itself as able to 'conceal and disguise the source' of customer cryptocurrency.”
reviewerDOJ quote: AudiA6 marketed itself as able to 'conceal and disguise the source' of customer cryptocurrencyExact quote confirmed. - #19[confirmed][no action needed]in section: Laundering Methodology
“AudiA6 operated commercial and controlled email domains to register exchange accounts and maintain operational infrastructure.”
reviewerAudiA6 operated commercial and controlled email domains to register exchange accounts and maintain infrastructureConfirmed. - #20[confirmed][no action needed]in section: Laundering Methodology
“TRM Labs identified a broader industry trend in which mixer volumes declined from $152 million in 2021 to $48 million in 2024, while cross-chain bridge flows reached $100 million in 2025, suggesting services like AudiA6 evolved their techniques over time.”
reviewerTRM Labs: mixer volumes declined from $152M (2021) to $48M (2024), while cross-chain bridge flows reached $100M (2025)Confirmed and accurately labeled as general industry trend rather than an AudiA6-specific figure. - #21[confirmed][no action needed]in section: Ransomware Gang Clientele
“On-chain analysis by TRM Labs identified 20 distinct ransomware groups that allegedly sent funds to AudiA6.”
reviewerTRM Labs identified 20 distinct ransomware groups that allegedly sent funds to AudiA6Confirmed. - #22[confirmed][no action needed]in section: Ransomware Gang Clientele
“The three largest by volume were ALPHV/BlackCat (approximately $9.1 million), Qilin (approximately $7.1 million), and LockBit (approximately $4.4 million).”
reviewerRansomware group dollar breakdown: ALPHV/BlackCat ~$9.1M, Qilin ~$7.1M, LockBit ~$4.4MConfirmed. - #23[confirmed][no action needed]in section: Ransomware Gang Clientele
“Additional ransomware groups identified by TRM Labs as AudiA6 customers include Chaos/Blacksuit ($3.65 million), RansomHub ($975,900), Akira ($386,200), and a group identified as The Gentlemen ($99,600).”
reviewerAdditional ransomware groups: Chaos/Blacksuit $3.65M, RansomHub $975,900, Akira $386,200, The Gentlemen $99,600Confirmed. - #24[confirmed][no action needed]in section: Ransomware Gang Clientele
“Europol and the DOJ stated that AudiA6 was linked to more than 15 investigations worldwide related to ransomware attacks and large-scale cryptocurrency theft.”
reviewerAudiA6 was linked to more than 15 investigations worldwide, per Europol and DOJConfirmed. - #25[confirmed][no action needed]in section: Ransomware Gang Clientele
“Separately, TRM Labs traced approximately $7 million in funds stolen during the 2022 LastPass data breach from Wasabi Wallet to AudiA6 as recently as September 2025, using cluster-level demixing, timing and amount alignment, and post-mix wallet analysis.”
reviewerTRM Labs traced ~$7 million in LastPass-breach funds from Wasabi Wallet to AudiA6 as recently as September 2025Confirmed, near-verbatim match to TRM Labs' own language. - #26[confirmed][no action needed]in section: Dark2Web Cybercrime Forum
“The suspected operators of AudiA6 are also believed to have administered Dark2Web, a dark web cybercrime forum described by Europol as a marketplace where cybercriminals advertised illicit services and connected with other threat actors worldwide.”
reviewerDark2Web is a dark web cybercrime forum described by Europol as a marketplace for illicit servicesConfirmed via search-indexed content of the cited article and corroborating outlets. - #27[confirmed][no action needed]in section: Dark2Web Cybercrime Forum
“The DOJ takedown operation seized infrastructure for both AudiA6 and the Dark2Web forum simultaneously. Law enforcement seizure banners were placed on both clear web and dark web domains associated with both services.”
reviewerThe DOJ takedown seized infrastructure for AudiA6 and Dark2Web simultaneously, with seizure banners on bothConfirmed. - #28[confirmed][no action needed]in section: Dark2Web Cybercrime Forum
“Attribution of the Dark2Web forum to Tkachuk and Ledenev is alleged by law enforcement and has not yet been adjudicated.”
reviewerAttribution of Dark2Web to Tkachuk and Ledenev is alleged, not yet adjudicatedAccurate hedge given the case is at the criminal-complaint stage. - #30[confirmed][no action needed]in section: International Law Enforcement Operation
“Approximately 393.39 BTC (valued at approximately $19.2 million at the time) were seized or traced as directly illicitly sourced.”
reviewerApproximately 393.39 BTC (~$19.2 million) were seized or traced as directly illicitly sourcedConfirmed. - #32[confirmed][no action needed]in section: International Law Enforcement Operation
“A prior arrest of one Ukrainian suspect in connection with the broader investigation had been carried out by Polish police in September 2025.”
reviewerA prior arrest of one Ukrainian suspect had been carried out by Polish police in September 2025Confirmed, near-verbatim match. - #33[confirmed][no action needed]in section: Seized Infrastructure
“Twenty-five domains associated with AudiA6 and its supporting infrastructure were seized as part of the June 2026 operation. Identified domains include designli.pictures, pheontx.eu, smplfy.in, sumato-soft.org, technobrains.dev, lett.email, trayo.app, postfast.eu, inboxly.top, and quix.express, among others.”
reviewerTwenty-five domains associated with AudiA6 were seized, including designli.pictures, pheontx.eu, smplfy.in, sumato-soft.org, and others listedCore count and first four domain names independently confirmed; the remaining six names were not individually cross-checked against a primary source in this review. - #34[confirmed][no action needed]in section: Seized Infrastructure
“Servers located in the United States, Iceland, Germany, and France were also targeted.”
reviewerServers located in the United States, Iceland, Germany, and France were also targetedConfirmed. - #35[confirmed][no action needed]in section: Extradition Status
“As of June 2026, Ruslan Igorevich Tkachuk and Alexander Vladimirovich Ledenev remain in the custody of Georgian authorities following their arrest in Batumi, Georgia on June 10, 2026. The US Attorney's Office for the Eastern District of Pennsylvania has stated it will seek extradition of both defendants to the United States to face the filed charges. No extradition has been confirmed as of the date of this report.”
reviewerAs of June 2026, both defendants remain in Georgian custody; extradition sought but not confirmedStill accurate based on searches through early September 2026. - #39[confirmed][no action needed]in the timeline
“Polish police arrest one Ukrainian suspect in connection with a related AudiA6 investigation, providing an early investigative lead.”
reviewerTimeline: Polish police arrest one Ukrainian suspect on 2025-09-01Confirmed; month-level precision (September 2025) matches source, day is a reasonable placeholder. - #40[confirmed][no action needed]in the timeline
“TRM Labs traces approximately $7 million in stolen LastPass funds from Wasabi Wallet to AudiA6 wallets using cluster-level demixing and timing analysis.”
reviewerTimeline: TRM Labs traces ~$7 million LastPass funds on 2025-12-01Confirmed; this entry correctly captures the December 2025 analysis date, unlike the earlier 2022-dated entry. - #41[confirmed][no action needed]in the timeline
“Coordinated international law enforcement operation dismantles AudiA6. Ruslan Igorevich Tkachuk (37) and Alexander Vladimirovich Ledenev (25) are arrested in Batumi, Georgia. Over 30 servers seized, 25 domains taken down, 80+ vehicles seized, Telegram accounts blocked, and cryptocurrency assets frozen.”
reviewerTimeline: coordinated operation dismantles AudiA6 on 2026-06-10 with arrests and seizuresConfirmed. - #42[confirmed][no action needed]in the timeline
“DOJ files criminal complaint in Eastern District of Pennsylvania. Europol and Chainalysis publish operational details. Seizure banners placed on AudiA6 and Dark2Web infrastructure.”
reviewerTimeline: DOJ files criminal complaint on 2026-06-11; Europol and Chainalysis publish operational detailsConfirmed. - #43[confirmed][no action needed]in the timeline
“Europol, Help Net Security, The Hacker News, and other outlets publish comprehensive coverage. TRM Labs identifies 20 distinct ransomware groups as AudiA6 customers.”
reviewerTimeline: comprehensive coverage published 2026-06-12; TRM Labs identifies 20 ransomware groupsConfirmed.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.