Audit log

Every state-changing event for AudiA6 Crypto Laundering Service: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-06-18 12:03:55Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 427,284,247

   sig

   3xf8y56DiJzP…Danw5wJycopyexplorer ↗

   hash

   Cb5oAvxVd8fm…7Y524jtRcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (19207 B) ▸

   {"actor":"system:backfill","investigation_id":"31eb64a3-0d31-4cf1-837d-c930c4d080d5","kind":"publish","page_slug":"audia6-crypto-laundering-service","published_at":"2026-06-18T12:03:54.938Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"AudiA6 Crypto Laundering Service","sections":[{"content":"AudiA6 operated as a professional cryptocurrency mixing service marketed on cybercrime forums, including the Dark2Web dark web forum that its alleged operators also ran. The service accepted stolen cryptocurrency proceeds from customers, obscured their origins through complex transaction chains, and returned cleaned funds to clients within approximately one hour. Operators charged commissions between 3% and 10% per transaction, with some reporting a standard rate of approximately 5%. The service advertised its ability to reduce the AML risk score of processed funds below 25%, a threshold used by many cryptocurrency exchanges as a trigger for suspicious activity reviews, effectively allowing cybercriminals to bypass exchange compliance systems. Investigators described the operation as an industrial-scale cryptocurrency laundering enterprise that maintained thousands of fraudulent exchange accounts opened using stolen or purchased identities, with over 6,000 Know Your Customer (KYC) records linked to money mule accounts identified during the investigation. The service also maintained infrastructure including Tor websites, Telegram channels, and cross-chain conversion capabilities. On its Dark2Web forum, the service openly advertised its willingness to launder funds traceable to criminal activity.","heading":"Overview and Operation","severity":"critical","sources":[{"credibility":1,"name":"Europol Press Release: Ransomware gangs cut from EUR 336 million AudiA6 crypto laundering pipeline","type":"regulatory","url":"https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline"},{"credibility":1,"name":"DOJ: Two Charged in Connection With Cryptocurrency Money Laundering Service That Allegedly Laundered Over $389 Million","type":"regulatory","url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"credibility":2,"name":"The Hacker News: Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"},{"credibility":2,"name":"Help Net Security: Authorities dismantle crypto laundering service that moved EUR 336 million for cybercriminals","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"}]},{"content":"The alleged administrators of AudiA6 are Ruslan Igorevich Tkachuk, a 37-year-old Ukrainian national, and Alexander Vladimirovich Ledenev, a 25-year-old Russian national. Both were arrested on June 10, 2026 in Batumi, Republic of Georgia. On June 2, 2026, prosecutors in the U.S. Eastern District of Pennsylvania filed a criminal complaint charging both individuals with one count of conspiracy to launder monetary instruments and one count of sting money laundering, each carrying a maximum penalty of 20 years in prison. U.S. authorities have stated they will seek extradition of both defendants to face charges in the United States. The criminal complaint alleges that Tkachuk and Ledenev are senior members of the AudiA6 organization and also manage the Dark2Web cybercrime forum, where AudiA6 advertised its services.","heading":"Alleged Operators and Arrests","severity":"critical","sources":[{"credibility":1,"name":"DOJ Eastern District of Pennsylvania: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"court_filing","url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"credibility":2,"name":"Cryptopolitan: US to seek extradition of AudiA6 duo over $389M crypto laundering scheme","type":"news_article","url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"},{"credibility":2,"name":"The Block: DOJ charges two in $389 million AudiA6 crypto laundering case","type":"news_article","url":"https://www.theblock.co/post/404433/doj-charges-two-389-million-audia6-crypto-laundering-case"}]},{"content":"Europol and the DOJ allege that AudiA6 laundered more than EUR 336 million (approximately USD 389 million) between 2022 and 2025. Approximately 10,333 Bitcoin were deposited into the service over the course of its operation, of which approximately 393.39 BTC (valued at approximately USD 19.2 million at the time of the transactions) were received directly from known darknet markets, ransomware organizations, cybercrime services, and other illicit sources. Additional funds were deposited indirectly from illicit sources into AudiA6 wallets. TRM Labs on-chain analysis identified approximately USD 79 million in directly traceable illicit exposure, of which approximately 80% (USD 63 million) was attributable to ransomware activity. The service was linked to more than 15 distinct international investigations involving ransomware attacks and large-scale cryptocurrency theft. TRM Labs analysis also identified a connection to approximately USD 7 million in funds stolen in the 2022 LastPass breach, tracing funds from Wasabi Wallet to AudiA6 through cluster-level demixing, timing and amount alignment, and post-mix wallet intelligence.","heading":"Scale and Financial Impact","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6","type":"research","url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"credibility":1,"name":"Europol Press Release: AudiA6 Crypto Laundering Pipeline","type":"regulatory","url":"https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline"},{"credibility":2,"name":"SC Media: AudiA6 cryptocurrency service dismantled for allegedly laundering over $380 million","type":"news_article","url":"https://www.scworld.com/brief/audia6-cryptocurrency-service-dismantled-for-laundering-over-380-million"}]},{"content":"TRM Labs on-chain analysis identified 20 distinct ransomware groups that sent funds to AudiA6 for laundering. The three largest client ransomware groups by funds processed were ALPHV BlackCat (USD 9.1 million), Qilin, also known as Agenda (USD 7.1 million), and LockBit (USD 4.4 million). Additional ransomware groups alleged to have used the service include Akira (USD 386,200), Chaos/Blacksuit (USD 3.65 million), The Gentlemen (USD 99,600), and RansomHub (USD 975,900). Beyond ransomware, the service is alleged to have laundered proceeds from darknet markets and other cybercrime services. Europol analysis linked the service to more than 15 separate international cybercrime investigations. AudiA6 was also connected to the Dark2Web cybercrime forum, where the service solicited criminal clients and facilitated access to a wider range of illicit services including commissioning crimes against specific targets.","heading":"Connections to Ransomware Groups and Cybercrime","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6","type":"on_chain","url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"credibility":1,"name":"Europol Press Release","type":"regulatory","url":"https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline"},{"credibility":2,"name":"Cybernews: Crypto laundering service AudiA6 shut down","type":"news_article","url":"https://cybernews.com/cybercrime/audia6-crypto-washing-shut-down/"}]},{"content":"AudiA6 maintained a substantial technical and financial infrastructure. Investigators seized more than 30 servers and took down 25 domains used by the service. The operators also maintained Tor websites, Telegram channels, and cross-chain conversion capabilities to move funds across blockchain networks. The service relied on a network of money mule accounts created with over 6,000 stolen or fraudulently obtained KYC records, with many mule accounts linked to Russian-speaking intermediaries. Nineteen domains used by AudiA6 for account registration were publicly disclosed by law enforcement to enable cryptocurrency exchanges to block associated accounts. At the time of the takedown, EUR 692,000 in cryptocurrency was frozen and EUR 86,000 in cryptocurrency was seized. In Georgia, authorities also seized more than 80 vehicles and multiple properties connected to the operation. The service's promotional materials claimed the ability to guarantee a sub-25% AML risk score on laundered funds, exploiting the compliance thresholds used by regulated cryptocurrency exchanges. TRM Labs noted that bridge infrastructure had surpassed mixer volumes for the first time in 2025, with cross-chain bridges processing USD 100 million in ransomware laundering flows during that year.","heading":"Infrastructure and Technical Methods","severity":"high","sources":[{"credibility":1,"name":"Europol Press Release","type":"regulatory","url":"https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline"},{"credibility":2,"name":"TRM Labs: International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6","type":"research","url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"credibility":2,"name":"AMBCrypto: DOJ says $389M crypto laundering network helped cybercriminals evade exchange AML systems","type":"news_article","url":"https://ambcrypto.com/doj-says-389m-crypto-laundering-network-helped-cybercriminals-evade-exchange-aml-systems/"}]},{"content":"The takedown of AudiA6 was the result of a coordinated international operation culminating in simultaneous actions on June 10, 2026. The operation was led by the U.S. Secret Service and IRS Criminal Investigation (IRS-CI), with coordination through Europol's European Cybercrime Centre (EC3), the Joint Cybercrime Action Taskforce (J-CAT), and Eurojust. Participating nations included Australia (Australian Federal Police), Canada (Royal Canadian Mounted Police), France (French Public Prosecutor's Office), Georgia, Germany (Federal Criminal Police Office), Iceland (Director of Public Prosecutions), Japan (National Police Agency), Poland (Regional Prosecutor's Office), Switzerland (Federal Office of Police), and the United Kingdom (National Crime Agency). The investigation was initiated in part by the Polish Police, who arrested a Ukrainian national on September 15, 2025 for money laundering activities connected to AudiA6. Forensic examination of seized devices from that arrest identified additional network members and led to the broader June 2026 operation. Criminal charges were filed on June 2, 2026, in the Eastern District of Pennsylvania, eight days before the coordinated takedown.","heading":"Law Enforcement Action and International Coordination","severity":"high","sources":[{"credibility":1,"name":"Europol Press Release","type":"regulatory","url":"https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline"},{"credibility":1,"name":"DOJ Eastern District of Pennsylvania Press Release","type":"regulatory","url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"credibility":2,"name":"Chainalysis: Global Law Enforcement Dismantles AudiA6 Laundering Network","type":"research","url":"https://www.chainalysis.com/blog/law-enforcement-dismantles-audia6-laundering-network-june-2026/"}]}],"sources_used":[{"credibility":1,"name":"Europol Press Release: Ransomware gangs cut from EUR 336 million AudiA6 crypto laundering pipeline","type":"regulatory","url":"https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline"},{"credibility":1,"name":"DOJ Eastern District of Pennsylvania: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"court_filing","url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"credibility":2,"name":"TRM Labs: International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6","type":"research","url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"credibility":2,"name":"Chainalysis: Global Law Enforcement Dismantles AudiA6 Laundering Network","type":"research","url":"https://www.chainalysis.com/blog/law-enforcement-dismantles-audia6-laundering-network-june-2026/"},{"credibility":2,"name":"The Hacker News: Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"},{"credibility":2,"name":"Help Net Security: Authorities dismantle crypto laundering service that moved EUR 336 million for cybercriminals","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"},{"credibility":2,"name":"BleepingComputer: Authorities dismantle AudiA6 ransomware crypto-laundering service","type":"news_article","url":"https://www.bleepingcomputer.com/news/legal/authorities-dismantle-audia6-ransomware-crypto-laundering-service/"},{"credibility":2,"name":"The Block: DOJ charges two in $389 million AudiA6 crypto laundering case","type":"news_article","url":"https://www.theblock.co/post/404433/doj-charges-two-389-million-audia6-crypto-laundering-case"},{"credibility":2,"name":"Cryptopolitan: US to seek extradition of AudiA6 duo over $389M crypto laundering scheme","type":"news_article","url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"},{"credibility":2,"name":"AMBCrypto: DOJ says $389M crypto laundering network helped cybercriminals evade exchange AML systems","type":"news_article","url":"https://ambcrypto.com/doj-says-389m-crypto-laundering-network-helped-cybercriminals-evade-exchange-aml-systems/"},{"credibility":2,"name":"SC Media: AudiA6 cryptocurrency service dismantled for allegedly laundering over $380 million","type":"news_article","url":"https://www.scworld.com/brief/audia6-cryptocurrency-service-dismantled-for-laundering-over-380-million"},{"credibility":2,"name":"Cybersecurity News: Authorities Dismantle Cryptocurrency Laundering Services AudiA6 Used by Ransomware Gangs","type":"news_article","url":"https://cybersecuritynews.com/authorities-dismantle-audia6-services/"},{"credibility":2,"name":"Protos: AudiA6 crypto laundering suspects face extradition to US","type":"news_article","url":"https://protos.com/audia6-crypto-laundering-suspects-face-extradition-to-us/"}],"summary":"AudiA6 was a professional cryptocurrency mixing and laundering service that allegedly processed over EUR 336 million (approximately USD 389 million) in illicit funds on behalf of ransomware gangs, darknet markets, and other cybercriminals between 2022 and 2025. An international law enforcement coalition led by Europol and the U.S. Department of Justice dismantled the service on June 10, 2026, arresting its two alleged administrators in Batumi, Georgia. The service has since been formally charged in the Eastern District of Pennsylvania.","timeline":[{"date":"2021-01-01","event":"AudiA6 cryptocurrency laundering service begins operations, according to DOJ allegations. The service is marketed on cybercrime forums including Dark2Web.","source":"DOJ Eastern District of Pennsylvania / Europol","source_url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"date":"2022-01-01","event":"Europol characterizes the primary operational period of AudiA6 as running from 2022 through 2025, during which EUR 336 million in alleged illicit funds were processed.","source":"Europol Press Release","source_url":"https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline"},{"date":"2022-12-01","event":"LastPass data breach results in approximately USD 7 million in stolen funds subsequently traced by TRM Labs through Wasabi Wallet to AudiA6 for laundering.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"date":"2025-09-15","event":"Polish Police arrest a Ukrainian national for money laundering activities connected to AudiA6. Forensic examination of seized electronic devices leads investigators to identify additional network members and the broader AudiA6 infrastructure.","source":"Europol Press Release","source_url":"https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline"},{"date":"2026-06-02","event":"Prosecutors in the U.S. Eastern District of Pennsylvania file a criminal complaint charging Ruslan Igorevich Tkachuk and Alexander Vladimirovich Ledenev with conspiracy to launder monetary instruments and sting money laundering.","source":"DOJ Eastern District of Pennsylvania","source_url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"date":"2026-06-10","event":"Coordinated international law enforcement action dismantles AudiA6. Tkachuk and Ledenev are arrested in Batumi, Georgia. Authorities seize 30+ servers, take down 25 domains, freeze EUR 692,000 in cryptocurrency, seize EUR 86,000 in cryptocurrency, and confiscate 80+ vehicles and multiple properties in Georgia.","source":"Europol / DOJ","source_url":"https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline"},{"date":"2026-06-11","event":"Europol and Chainalysis publish public announcements detailing the AudiA6 takedown. TRM Labs publishes on-chain analysis identifying 20 ransomware groups that used the service, led by ALPHV BlackCat, Qilin, and LockBit.","source":"Chainalysis / TRM Labs","source_url":"https://www.chainalysis.com/blog/law-enforcement-dismantles-audia6-laundering-network-june-2026/"},{"date":"2026-06-12","event":"U.S. authorities confirm they will seek extradition of Tkachuk and Ledenev from Georgia to face charges in the Eastern District of Pennsylvania.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 6d1a6ca0-96db-446e-a79e-2ad3f93756d7copy