Audit log

Every state-changing event for Ruslan Igorevich Tkachuk: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-06-27 17:06:23Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 429,278,140

   sig

   5ZJWZoKSAgff…LhCBY2cZcopyexplorer ↗

   hash

   FgLJEkhHJnEd…HbkhUd6ccopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (15070 B) ▸

   {"actor":"system:backfill","investigation_id":"2121c9c9-2385-4ed8-ac8b-4b50f3debc7e","kind":"publish","page_slug":"ruslan-igorevich-tkachuk","published_at":"2026-06-27T17:06:23.471Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Ruslan Igorevich Tkachuk","sections":[{"content":"Ruslan Igorevich Tkachuk, age 37, is a Ukrainian national who was residing in Batumi, Republic of Georgia at the time of his arrest. He is identified in U.S. federal charging documents as a senior member of the AudiA6 criminal organization. His co-defendant, Alexander Vladimirovich Ledenev, age 25, a Russian national also residing in Batumi, was arrested simultaneously. Both men communicated primarily in Russian, according to records of undercover law enforcement interactions described in court filings.","heading":"Identity and Background","severity":"critical","sources":[{"credibility":1,"name":"U.S. Secret Service: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"credibility":1,"name":"DOJ Eastern District of Pennsylvania: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"}]},{"content":"Tkachuk was charged by criminal complaint in the Eastern District of Pennsylvania with two counts: (1) conspiracy to launder monetary instruments and (2) sting money laundering. The charges were brought by the U.S. Attorney's Office for the Eastern District of Pennsylvania, with Assistant U.S. Attorneys Benjamin D. Traster and Sima Kazmir handling prosecution. If convicted on both counts, Tkachuk faces a maximum sentence of 20 years in federal prison. As of June 2026, he remains in Georgian custody and the U.S. Attorney's Office has formally sought extradition.","heading":"Criminal Charges","severity":"critical","sources":[{"credibility":1,"name":"U.S. Secret Service: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"credibility":1,"name":"DOJ Eastern District of Pennsylvania press release","type":"regulatory","url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"credibility":2,"name":"Cryptopolitan: US to seek extradition of AudiA6 duo over $389M crypto laundering scheme","type":"news_article","url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"}]},{"content":"Tkachuk is alleged to have co-administered AudiA6, a cryptocurrency money laundering service launched in 2021. AudiA6 operated as an industrial-scale mixing and layering operation, marketing itself on the premise of anonymity and speed. The service advertised on the Dark2Web cybercrime forum, which Tkachuk and Ledenev are also alleged to have administered. AudiA6 charged commissions of between 3% and 10% per transaction, with a posted rate of up to 5% cited in charging documents. The service completed transactions in approximately one hour, routing funds through complex chains of transactions designed to obscure origins. It maintained more than 6,000 fraudulent Know Your Customer (KYC) records linked to money mule accounts, many tied to Russian-speaking intermediaries. According to Europol, AudiA6 processed approximately 10,333 Bitcoin, representing roughly EUR 336 million (approximately $389 million), between its 2021 launch and the June 2026 takedown. Of that total, approximately 393.39 BTC (approximately $19.2 million) was directly traceable to known darknet markets, ransomware organizations, and cybercrime services.","heading":"AudiA6 Operation","severity":"critical","sources":[{"credibility":1,"name":"Europol: Ransomware gangs cut off from EUR 336 million AudiA6 crypto laundering pipeline","type":"regulatory","url":"https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline"},{"credibility":1,"name":"U.S. Secret Service: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"credibility":2,"name":"The Hacker News: Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"}]},{"content":"According to Europol, the AudiA6 investigation was linked to more than 15 international cybercrime investigations involving ransomware attacks and cryptocurrency theft. The Philadelphia Inquirer reported that prosecutors identified illicit funding sources including ransomware attack perpetrators, recipients of stolen online funds, and drug trafficking proceeds. In an undercover operation spanning December 2022 through May 2026, law enforcement agents conducted six covert transactions with AudiA6 operators. Communications were typically conducted in Russian. When an undercover agent inquired about laundering funds described as derived from scams, the AudiA6 operator allegedly responded that the service did not care about the origin of funds. The service is alleged to have retained more than $10 million in profits from its commission fees over the course of its operation.","heading":"Ransomware and Darknet Clientele","severity":"critical","sources":[{"credibility":1,"name":"Europol: Ransomware gangs cut off from EUR 336 million AudiA6 crypto laundering pipeline","type":"regulatory","url":"https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline"},{"credibility":2,"name":"Philadelphia Inquirer: Bitcoin crypto money laundering dark web AudiA6 arrested","type":"news_article","url":"https://www.inquirer.com/crime/bitcoin-crypto-money-laundering-dark-web-audia6-arrested-20260611.html"},{"credibility":2,"name":"The Hacker News: Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"}]},{"content":"The June 10, 2026 takedown was a coordinated multinational operation designated by Europol and Eurojust. Participating countries included Australia, Canada, France, Georgia, Germany, Iceland, Japan, Poland, Switzerland, the United Kingdom, and the United States. U.S. agencies involved included the U.S. Secret Service and IRS Criminal Investigation. The operation resulted in 25 domains taken down, more than 30 servers seized (located in the U.S., Iceland, Germany, and France), Telegram accounts associated with AudiA6 blocked, websites replaced with law enforcement seizure banners, 3 properties searched, and 80 or more vehicles seized in Georgia. Europol reported EUR 692,000 in cryptocurrency frozen and EUR 86,000 in cryptocurrency seized. A third individual, a Ukrainian national, had been arrested separately by Polish Police on September 15, 2025, in a related enforcement action. Europol also made public 19 suspicious domain names used by AudiA6 to assist cryptocurrency exchanges in identifying exposure.","heading":"Law Enforcement Operation and Asset Seizures","severity":"high","sources":[{"credibility":1,"name":"Europol: Ransomware gangs cut off from EUR 336 million AudiA6 crypto laundering pipeline","type":"regulatory","url":"https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline"},{"credibility":2,"name":"Cryptopolitan: US to seek extradition of AudiA6 duo over $389M crypto laundering scheme","type":"news_article","url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"},{"credibility":2,"name":"The Hacker News: Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"}]},{"content":"In addition to the AudiA6 laundering service, Tkachuk and Ledenev are alleged in charging documents to have co-administered Dark2Web, a dark web cybercrime forum. Dark2Web allegedly served as a marketplace where threat actors advertised illicit services and connected with criminal counterparts globally. AudiA6 used the forum to advertise its laundering services, including an explicit offer to conceal the origin of cryptocurrency traceable to criminal activity for a fee of up to five percent. The forum's role as a nexus between AudiA6 and its ransomware and darknet market customers is cited in the criminal complaint.","heading":"Dark2Web Cybercrime Forum","severity":"critical","sources":[{"credibility":1,"name":"U.S. Secret Service: Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"credibility":2,"name":"The Hacker News: Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"}]},{"content":"As of June 2026, Tkachuk is held in Georgian custody following his arrest in Batumi on June 10, 2026. The U.S. Attorney's Office for the Eastern District of Pennsylvania has formally sought extradition to the United States. No extradition ruling or timeline has been publicly reported. The charges remain allegations at this stage; Tkachuk has not been convicted, and no guilty plea has been reported.","heading":"Extradition Status","severity":"high","sources":[{"credibility":1,"name":"DOJ Eastern District of Pennsylvania press release","type":"regulatory","url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"credibility":2,"name":"Cryptopolitan: US to seek extradition of AudiA6 duo over $389M crypto laundering scheme","type":"news_article","url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"}]}],"sources_used":[{"credibility":1,"name":"U.S. Secret Service: Two Charged in Connection With Cryptocurrency Money Laundering Service That Allegedly Laundered Over $389 Million","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"credibility":1,"name":"DOJ Eastern District of Pennsylvania: Two Charged in Connection With Cryptocurrency Money Laundering Service That Allegedly Laundered Over $389 Million","type":"regulatory","url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"credibility":1,"name":"Europol: Ransomware gangs cut off from EUR 336 million AudiA6 crypto laundering pipeline","type":"regulatory","url":"https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline"},{"credibility":2,"name":"The Hacker News: Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"},{"credibility":2,"name":"Philadelphia Inquirer: Bitcoin crypto money laundering dark web AudiA6 arrested","type":"news_article","url":"https://www.inquirer.com/crime/bitcoin-crypto-money-laundering-dark-web-audia6-arrested-20260611.html"},{"credibility":2,"name":"Cryptopolitan: US to seek extradition of AudiA6 duo over $389M crypto laundering scheme","type":"news_article","url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"},{"credibility":2,"name":"The Block: DOJ charges two in $389 million AudiA6 crypto laundering case","type":"news_article","url":"https://www.theblock.co/post/404433/doj-charges-two-389-million-audia6-crypto-laundering-case"}],"summary":"Ruslan Igorevich Tkachuk is a 37-year-old Ukrainian national charged by the U.S. Department of Justice in June 2026 as an alleged senior administrator of AudiA6, a cryptocurrency money laundering service that processed approximately $389 million in illicit transactions since 2021. Tkachuk was arrested in Batumi, Georgia on June 10, 2026, as part of a coordinated multinational law enforcement operation involving Europol, Eurojust, the U.S. Secret Service, IRS Criminal Investigation, and authorities from over a dozen countries. He is currently in Georgian custody awaiting extradition to the Eastern District of Pennsylvania, where he faces up to 20 years in federal prison if convicted.","timeline":[{"date":"2021-01-01","event":"AudiA6 cryptocurrency laundering service allegedly launched, with Tkachuk as a co-administrator.","source":"U.S. Secret Service press release","source_url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"date":"2022-12-01","event":"U.S. law enforcement begins undercover operation against AudiA6, conducting the first of six covert transactions.","source":"Philadelphia Inquirer","source_url":"https://www.inquirer.com/crime/bitcoin-crypto-money-laundering-dark-web-audia6-arrested-20260611.html"},{"date":"2025-09-15","event":"A third individual, a Ukrainian national, is arrested by Polish Police in a related AudiA6 enforcement action.","source":"Europol press release","source_url":"https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline"},{"date":"2026-05-01","event":"Final undercover transaction in the AudiA6 investigation conducted by law enforcement agents.","source":"Philadelphia Inquirer","source_url":"https://www.inquirer.com/crime/bitcoin-crypto-money-laundering-dark-web-audia6-arrested-20260611.html"},{"date":"2026-06-10","event":"Tkachuk and co-defendant Alexander Vladimirovich Ledenev arrested in Batumi, Georgia. Coordinated multinational law enforcement operation seizes servers across the U.S., Iceland, Germany, and France; 25 domains taken down; Telegram accounts blocked.","source":"Europol press release","source_url":"https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline"},{"date":"2026-06-11","event":"U.S. Department of Justice and U.S. Secret Service publicly announce charges against Tkachuk and Ledenev. DOJ seeks extradition to the Eastern District of Pennsylvania.","source":"DOJ Eastern District of Pennsylvania","source_url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 270117d6-da7f-4766-8211-cc953802f227copy
2. #2rescoreby systemsystem

   2026-10-10 18:39:55Z
   Score: 2 → 26 (+24)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 2 → 26. Problems weighed by who is responsible: the subject's own conduct −100, problems around the subject, caused by others −5.5; legitimacy credit long-running +10; no established finding that it defrauded anyone, so it stays out of the red band.
   anchoranchored

   chain

   ●mainnet-betaslot 455,358,051

   sig

   5JMTkkrjYWSj…kbS8nTdVcopyexplorer ↗

   hash

   F5mW2k2iZYeH…xoyL6LVvcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (697 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:39:55.115Z","decision":"rescore","investigation_id":"2121c9c9-2385-4ed8-ac8b-4b50f3debc7e","new_score":26,"page_slug":"ruslan-igorevich-tkachuk","prev_score":2,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 2 → 26. Problems weighed by who is responsible: the subject's own conduct −100, problems around the subject, caused by others −5.5; legitimacy credit long-running +10; no established finding that it defrauded anyone, so it stays out of the red band.","score_delta":24,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 80db612d-ce92-4d10-805d-f68f027ac274copy
3. #3reviewby reviewerreviewer

   2026-11-04 00:05:31Z
   Score: 26 → 26 (no score change)
   The core facts (identity, charges, arrest in Batumi, EUR 336M / $389M scale, extradition request) are corroborated by search summaries of Europol, DOJ and IRS-CI. The detailed operational figures and the undercover timeline could not be read in the primary sources. The page is not updated beyond June 2026. The $389M and EUR 336M figures are attributed to Europol alone but come from two agencies.
   anchoranchored

   chain

   ●mainnet-betaslot 465,093,906

   sig

   4M33P9RoaR6W…m86PeUKRcopyexplorer ↗

   hash

   3yMKRovJXULq…ZQAR2Ws7copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1254 B) ▸

   {"actor":"reviewer","artifact_identity":"af55cc1fe2c226bbecd51944d8b3d3d9","blocked_count":2,"decided_at":"2026-11-04T00:05:31.736Z","decision":"review","disputed_pct":0,"findings_hash":"4rjMrFAY5ZxL6188go3bWy84A5eu91tV7WbcxSCetu4x","investigation_id":"2121c9c9-2385-4ed8-ac8b-4b50f3debc7e","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":26,"page_content_hash":"a2926249496cf187e35ab075a50b506283e4a0331d515a40089eb81be892caeb","page_slug":"ruslan-igorevich-tkachuk","prev_score":26,"reason":"The core facts (identity, charges, arrest in Batumi, EUR 336M / $389M scale, extradition request) are corroborated by search summaries of Europol, DOJ and IRS-CI. The detailed operational figures and the undercover timeline could not be read in the primary sources. The page is not updated beyond June 2026. The $389M and EUR 336M figures are attributed to Europol alone but come from two agencies.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"scored_claims":5,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 13304db4-0839-4a45-8f80-065dd15032c7copy
4. #4review reviseby judgejudge

   2026-11-04 00:05:31Z
   Score: 26 → 26 (no score change)
   No claim was disputed: of 7 findings, 2 were unverifiable only because the source blocked the reviewer (claim_findings[3], [5]) and are excluded, leaving 5 with 0% disputed or unverifiable. The core facts (identity, charges, Batumi arrest, EUR 336M / $389M scale) were corroborated through search summaries of Europol and DOJ, though the primary pages did not load. The page says Tkachuk is 'currently' in Georgian custody, but the reviewer found nothing after June 2026, so that status is five months old and unconfirmed (high-priority coverage gap). The EUR 336M and $389M figures are also credited to Europol alone when they come from two agencies (claim_findings[2]). These are small corrections, not a failed page.
   anchoranchored

   chain

   ●mainnet-betaslot 465,093,911

   sig

   2wsgn9towZgX…bC1ui5mQcopyexplorer ↗

   hash

   HKoVgG8RFvNC…8aPDRT6wcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2272 B) ▸

   {"actor":"judge","artifact_identity":"af55cc1fe2c226bbecd51944d8b3d3d9","band_override":{"actual_delta":-5,"actual_verdict":"review_revise","disputed_pct":0,"expected_delta_range":[0,0],"expected_verdict":"review_approve","rationale":"No claim was disputed: of 7 findings, 2 were unverifiable only because the source blocked the reviewer (claim_findings[3], [5]) and are excluded, leaving 5 with 0% disputed or unverifiable. The core facts (identity, charges, Batumi arrest, EUR 336M / $389M scale) were corroborated through search summaries of Europol and DOJ, though the primary pages did not load. The page says Tkachuk is 'currently' in Georgian custody, but the reviewer found nothing after June 2026, so that status is five months old and unconfirmed (high-priority coverage gap). The EUR 336M and $389M figures are also credited to Europol alone when they come from two agencies (claim_findings[2]). These are small corrections, not a failed page."},"blocked_count":2,"decided_at":"2026-11-04T00:05:31.736Z","decision":"review_revise","delist_requested":false,"disputed_pct":0,"investigation_id":"2121c9c9-2385-4ed8-ac8b-4b50f3debc7e","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":26,"page_slug":"ruslan-igorevich-tkachuk","prev_score":26,"reason":"No claim was disputed: of 7 findings, 2 were unverifiable only because the source blocked the reviewer (claim_findings[3], [5]) and are excluded, leaving 5 with 0% disputed or unverifiable. The core facts (identity, charges, Batumi arrest, EUR 336M / $389M scale) were corroborated through search summaries of Europol and DOJ, though the primary pages did not load. The page says Tkachuk is 'currently' in Georgian custody, but the reviewer found nothing after June 2026, so that status is five months old and unconfirmed (high-priority coverage gap). The EUR 336M and $389M figures are also credited to Europol alone when they come from two agencies (claim_findings[2]). These are small corrections, not a failed page.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"scored_claims":5,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8957f46e-bf8b-47d4-864d-7e28d945df23copy