Verify a decision

{"actor":"system:backfill","investigation_id":"70c2d847-3411-4499-91bb-79006efba6ca","kind":"publish","page_slug":"dark2web","published_at":"2026-06-27T17:03:36.913Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Dark2Web","sections":[{"content":"Dark2Web was a cybercrime forum that operated on both the clear web and the dark web. According to the U.S. Secret Service and the U.S. Attorney's Office for the Eastern District of Pennsylvania, the forum functioned as the primary advertising channel for the AudiA6 cryptocurrency laundering service. A Dark2Web advertisement cited in the criminal complaint explicitly offered to 'conceal and disguise the source of any prospective customer's cryptocurrency that would otherwise be traceable to criminal sources, for a fee of up to five percent of the amount of funds being laundered.' Beyond advertising AudiA6, the forum served as a watering hole where ransomware affiliates, hackers, and other threat actors could network, trade services, and arrange illicit transactions. TRM Labs characterized it as a node within the financial backbone of the underground cybercrime economy.","heading":"Overview and Purpose","severity":"critical","sources":[{"credibility":1,"name":"U.S. Secret Service — Two Charged in Connection With AudiA6 Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"credibility":2,"name":"TRM Labs — International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6","type":"research","url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"credibility":2,"name":"HackRead — Feds Seize AudiA6 and Dark2Web in $389M Crypto Laundering Case","type":"news_article","url":"https://hackread.com/feds-seize-audia6-dark2web-crypto-laundering-case/"}]},{"content":"The criminal complaint filed on June 2, 2026, in the U.S. District Court for the Eastern District of Pennsylvania names two alleged senior administrators of both Dark2Web and AudiA6. Ruslan Igorevich Tkachuk, 37, a Ukrainian national, and Alexander Vladimirovich Ledenev, 25, a Russian national, both resided in Batumi, Republic of Georgia at the time of their arrest. Both were apprehended on June 10, 2026, in coordinated actions by Georgian authorities acting at the request of U.S. law enforcement. The complaint charges each defendant with one count of conspiracy to launder monetary instruments and one count of sting money laundering. If convicted, each faces a maximum sentence of 20 years of incarceration. The U.S. Attorney's Office will seek extradition to the Eastern District of Pennsylvania. As of the date of seizure, both defendants remained in Georgian custody awaiting extradition proceedings.","heading":"Operators and Criminal Charges","severity":"critical","sources":[{"credibility":1,"name":"DOJ EDPA — Two Charged in Connection With Cryptocurrency Money Laundering Service That Allegedly Laundered Over $389 Million","type":"court_filing","url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"credibility":1,"name":"U.S. Secret Service — Two Charged in Connection With AudiA6 Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"credibility":2,"name":"The Hacker News — Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"}]},{"content":"Dark2Web maintained both a clear-web presence and a dark-web (.onion) presence. On June 10-11, 2026, law enforcement replaced the websites for both Dark2Web and AudiA6 with law enforcement seizure banners. As part of the broader AudiA6 takedown operation, authorities seized more than 30 servers and took down 25 domains. Servers and infrastructure were targeted across the United States, Iceland, Germany, and France. Three properties in Georgia were searched. No specific technical details about Dark2Web's hosting architecture, its domain names prior to seizure, or the number of registered users have been disclosed in publicly available sources.","heading":"Infrastructure and Seizure","severity":"critical","sources":[{"credibility":1,"name":"U.S. Secret Service — Two Charged in Connection With AudiA6 Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"credibility":2,"name":"HelpNet Security — Europol AudiA6 Crypto Laundering Service Ransomware Groups","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"},{"credibility":2,"name":"Bleeping Computer — Authorities Dismantle AudiA6 Ransomware Crypto Laundering Service","type":"news_article","url":"https://www.bleepingcomputer.com/news/legal/authorities-dismantle-audia6-ransomware-crypto-laundering-service/"}]},{"content":"Dark2Web functioned as the advertising and networking arm of the AudiA6 cryptocurrency laundering operation. AudiA6 itself received approximately 10,333 BTC — valued at approximately $389.7 million at the time of the relevant transactions — across wallets active since 2021. Of that total, at least 393.39 BTC (approximately $19.2 million) was traced directly from known ransomware organizations and darknet markets. TRM Labs identified 20 distinct ransomware groups that sent funds to AudiA6. The three largest sources by volume were ALPHV/BlackCat (approximately $9.1 million), Qilin (approximately $7.1 million), and LockBit (approximately $4.4 million). Europol described the total illicit proceeds processed by AudiA6 as exceeding EUR 336 million between 2022 and 2025. Dark2Web served as the primary venue through which ransomware affiliates learned of and connected with AudiA6's services.","heading":"Relationship to AudiA6 and Ransomware Ecosystem","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs — International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6","type":"research","url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"credibility":2,"name":"HackRead — Feds Seize AudiA6 and Dark2Web in $389M Crypto Laundering Case","type":"news_article","url":"https://hackread.com/feds-seize-audia6-dark2web-crypto-laundering-case/"},{"credibility":2,"name":"HelpNet Security — Europol AudiA6 Crypto Laundering Service Ransomware Groups","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"}]},{"content":"The takedown of Dark2Web and AudiA6 was a multi-jurisdictional operation announced publicly on June 11, 2026. Primary U.S. agencies included the U.S. Secret Service Cyber Investigative Section and IRS Criminal Investigation. International coordination was facilitated by Europol and Eurojust, with investigative partners from Australia, Canada, France, Georgia, Germany, Iceland, Japan, Poland, Switzerland, and the United Kingdom. The operation included simultaneous arrests, property searches, server seizures, domain takedowns, and the blocking of linked Telegram accounts. Prosecutors in the Eastern District of Pennsylvania charged the two defendants and will pursue extradition from Georgia.","heading":"Law Enforcement Action and Participating Agencies","severity":"high","sources":[{"credibility":1,"name":"DOJ EDPA — Two Charged in Connection With Cryptocurrency Money Laundering Service That Allegedly Laundered Over $389 Million","type":"court_filing","url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"credibility":2,"name":"The Hacker News — Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"},{"credibility":2,"name":"Decrypt — Authorities Take Down AudiA6 Group That Allegedly Laundered $389 Million in Bitcoin","type":"news_article","url":"https://decrypt.co/370812/authorities-take-down-audia6-allegedly-laundered-389-million-bitcoin"}]},{"content":"As of June 2026, Dark2Web is offline and its domains have been seized by law enforcement. Both alleged administrators, Tkachuk and Ledenev, are in Georgian custody. No trial date has been reported in publicly available sources. The criminal complaint remains the operative charging document; no indictment has been publicly reported. The extradition process to the Eastern District of Pennsylvania is pending. No successor forum has been identified in publicly available sources at the time of this investigation.","heading":"Current Status","severity":"low","sources":[{"credibility":1,"name":"U.S. Secret Service — Two Charged in Connection With AudiA6 Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"credibility":2,"name":"Cryptopolitan — US to Seek Extradition of AudiA6 Duo Over $389M Crypto Laundering Scheme","type":"news_article","url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"}]}],"sources_used":[{"credibility":1,"name":"DOJ EDPA — Two Charged in Connection With Cryptocurrency Money Laundering Service That Allegedly Laundered Over $389 Million","type":"court_filing","url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"credibility":1,"name":"U.S. Secret Service — Two Charged in Connection With Cryptocurrency Money Laundering Service","type":"regulatory","url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"credibility":2,"name":"The Hacker News — Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"},{"credibility":2,"name":"HackRead — Feds Seize AudiA6 and Dark2Web in $389M Crypto Laundering Case","type":"news_article","url":"https://hackread.com/feds-seize-audia6-dark2web-crypto-laundering-case/"},{"credibility":2,"name":"HelpNet Security — Europol AudiA6 Crypto Laundering Service Ransomware Groups","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"},{"credibility":2,"name":"Bleeping Computer — Authorities Dismantle AudiA6 Ransomware Crypto Laundering Service","type":"news_article","url":"https://www.bleepingcomputer.com/news/legal/authorities-dismantle-audia6-ransomware-crypto-laundering-service/"},{"credibility":2,"name":"TRM Labs — International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6","type":"research","url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"credibility":2,"name":"Decrypt — Authorities Take Down AudiA6 Group That Allegedly Laundered $389 Million in Bitcoin","type":"news_article","url":"https://decrypt.co/370812/authorities-take-down-audia6-allegedly-laundered-389-million-bitcoin"},{"credibility":2,"name":"Cryptopolitan — US to Seek Extradition of AudiA6 Duo Over $389M Crypto Laundering Scheme","type":"news_article","url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"}],"summary":"Dark2Web was a darknet and clear-web cybercrime forum operated by the same individuals who ran the AudiA6 cryptocurrency laundering service. It served as the primary advertising hub and networking venue for ransomware affiliates, hackers, and other cybercriminals who used AudiA6 to launder proceeds. Both platforms were seized by an international law enforcement coalition on June 10-11, 2026, and their two alleged administrators were arrested in Georgia and face extradition to the United States.","timeline":[{"date":"2021-01-01","event":"AudiA6 cryptocurrency laundering service launched. Dark2Web was used from this period to advertise the service to criminal actors. Exact launch date of Dark2Web itself is not publicly known.","source":"U.S. Secret Service press release","source_url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"date":"2026-06-02","event":"Criminal complaint filed in the Eastern District of Pennsylvania charging Ruslan Igorevich Tkachuk and Alexander Vladimirovich Ledenev with conspiracy to launder monetary instruments and sting money laundering in connection with AudiA6 and Dark2Web.","source":"DOJ EDPA press release","source_url":"https://www.justice.gov/usao-edpa/pr/two-charged-connection-cryptocurrency-money-laundering-service-allegedly-laundered"},{"date":"2026-06-10","event":"Coordinated international law enforcement actions executed: Tkachuk and Ledenev arrested in Batumi, Georgia. Three properties searched. More than 30 servers seized and 25 domains taken down across the US, Iceland, Germany, and France. Linked Telegram accounts blocked.","source":"HelpNet Security / Europol","source_url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"},{"date":"2026-06-11","event":"Dark2Web and AudiA6 websites — on both clear web and dark web — replaced with law enforcement seizure banners. Europol and DOJ publicly announce the operation.","source":"U.S. Secret Service press release","source_url":"https://www.secretservice.gov/newsroom/releases/2026/06/two-charged-connection-cryptocurrency-money-laundering-service-allegedly"},{"date":"2026-06-12","event":"Europol issues public statement characterizing AudiA6/Dark2Web as a 'key financial pipeline used to wash hundreds of millions in illicit profits.' Reporting confirms extradition proceedings to the Eastern District of Pennsylvania are pending.","source":"HelpNet Security","source_url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"}]},"v":1}