Verify a decision

{"actor":"system:backfill","investigation_id":"ea89f009-d5f5-4c59-9b8e-d7cd672c067a","kind":"publish","page_slug":"audia6","published_at":"2026-06-14T14:18:58.231Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"AudiA6","sections":[{"content":"AudiA6 marketed itself on darknet forums as a professional cryptocurrency mixing service guaranteeing anonymity and speed. Clients transferred illicit cryptocurrency proceeds to operator-controlled wallets and allegedly received 'cleaned' funds within approximately one hour through complex transaction chains. The service charged commission fees ranging from 3% to 10% per transaction. According to blockchain analysis conducted by TRM Labs and cited by the U.S. Department of Justice, approximately 10,333 Bitcoin — valued at roughly $389.8 million at the time of transactions — was deposited into AudiA6-controlled wallets between the service's 2021 launch and its June 2026 takedown. The operators are alleged to have relied on thousands of fraudulent exchange accounts opened using stolen or purchased identities to move funds. Despite promises of untraceable transactions, investigators determined that transactions were directly traceable through exchange records.","heading":"Service Overview","severity":"critical","sources":[{"credibility":2,"name":"Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"},{"credibility":2,"name":"International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6 — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"credibility":1,"name":"Philly feds charge two with running a cryptocurrency money laundering scheme — Philadelphia Inquirer","type":"news_article","url":"https://www.inquirer.com/crime/bitcoin-crypto-money-laundering-dark-web-audia6-arrested-20260611.html"}]},{"content":"The U.S. Attorney's Office for the Eastern District of Pennsylvania announced charges on June 11, 2026, against Ruslan Igorevich Tkachuk, 37, a Ukrainian national, and Alexander Vladimirovich Ledenev, 25, a Russian national. Each defendant faces one count of conspiracy to launder monetary instruments and one count of sting money laundering, with a maximum sentence of 20 years per count. The prosecution is being handled by Assistant U.S. Attorneys Benjamin D. Traster and Sima Kazmir, with support from the DOJ's Office of International Affairs. U.S. Attorney David Metcalf of the Eastern District of Pennsylvania is overseeing the case. The DOJ documented six undercover transactions conducted between December 2022 and May 2026. In one transaction from April 2026, investigators submitted $5,000 in Bitcoin and were charged a $300 fee; in another, $5,100 in Bitcoin was submitted with a $400 fee. When an undercover agent asked whether cocaine proceeds could be laundered, an alleged operator responded 'don't care.' Both defendants remain in Georgian custody, and the U.S. has indicated it will seek extradition.","heading":"U.S. Federal Charges","severity":"critical","sources":[{"credibility":1,"name":"Philly feds charge two with running a cryptocurrency money laundering scheme — Philadelphia Inquirer","type":"news_article","url":"https://www.inquirer.com/crime/bitcoin-crypto-money-laundering-dark-web-audia6-arrested-20260611.html"},{"credibility":2,"name":"US to seek extradition of AudiA6 duo over $389M crypto laundering scheme — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"},{"credibility":2,"name":"Authorities dismantle AudiA6 ransomware crypto-laundering service — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/legal/authorities-dismantle-audia6-ransomware-crypto-laundering-service/"}]},{"content":"On-chain analysis by TRM Labs identified 20 distinct ransomware groups that routed funds through AudiA6. The three largest individual sources were ALPHV BlackCat ($9.1 million), Qilin ($7.1 million), and LockBit ($4.4 million). Additional identified sources included Chaos/Blacksuit ($3.65 million), RansomHub ($975,900), and Akira ($386,200). Darknet marketplaces Exploit and Verified also allegedly sent proceeds through the service. In total, approximately 393.39 BTC — valued at roughly $19.2 million — has been directly attributed to ransomware organizations and darknet markets, with the broader $389 million figure reflecting all funds processed through AudiA6 wallets. TRM Labs found that approximately 80% of AudiA6's traced exposure (roughly $63 million of $79 million total traced) connected to ransomware. The service's illicit share of total volume rose from under 1% in 2022 to over 6% in 2024, indicating an increasing concentration of high-risk criminal clientele over time. The AudiA6 network was also linked to more than 15 active international investigations worldwide.","heading":"Ransomware and Cybercrime Client Base","severity":"critical","sources":[{"credibility":2,"name":"International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6 — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"credibility":2,"name":"Global Law Enforcement Dismantles AudiA6 Crypto Laundering Network — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/law-enforcement-dismantles-audia6-laundering-network-june-2026/"},{"credibility":2,"name":"11-Nation Sting Shuts AudiA6 Crypto Mixer, 336M for Ransomware — GnCrypto News","type":"news_article","url":"https://www.gncrypto.news/news/11-nation-sting-shuts-audia6-crypto-mixer-336m-ransomware/"}]},{"content":"The operators of AudiA6 are alleged to have also administered a dark web cybercrime forum known as Dark2Web, where cybercriminals advertised illicit services including AudiA6's mixing capabilities. Dark2Web served as the primary advertising and client-acquisition channel for AudiA6, connecting the service with ransomware operators, darknet market participants, and other criminal actors. The forum was seized and taken offline as part of the June 2026 enforcement action. Law enforcement seized both clear web and dark web properties associated with Dark2Web, and Telegram accounts linked to the operation were blocked.","heading":"Dark2Web Cybercrime Forum","severity":"critical","sources":[{"credibility":2,"name":"Feds Seize AudiA6 and Dark2Web in $389M Crypto Laundering Case — HackRead","type":"news_article","url":"https://hackread.com/feds-seize-audia6-dark2web-crypto-laundering-case/"},{"credibility":2,"name":"Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"}]},{"content":"The takedown of AudiA6 was executed on June 10, 2026, and announced publicly on June 11, 2026. The operation was coordinated by Europol's European Cybercrime Centre (EC3) and the Joint Cybercrime Action Taskforce (J-CAT), with judicial cooperation facilitated by Eurojust across France, Poland, Georgia, and Iceland. Participating law enforcement agencies included the U.S. Secret Service Cyber Investigative Section, IRS Criminal Investigation, Polish Police (CBZC), and national agencies from Australia, Canada, France, Germany, Iceland, Japan, Switzerland, and the United Kingdom — at minimum 11 nations in total. The investigation originated from a September 2025 Polish Police operation that resulted in the arrest of a Ukrainian national for alleged involvement in AudiA6-related money laundering, which led investigators to the two primary operators. More than 6,000 Know Your Customer records connected to alleged money mule accounts were uncovered during the investigation.","heading":"International Law Enforcement Operation","severity":"high","sources":[{"credibility":2,"name":"Authorities dismantle crypto laundering service that moved 336 million for cybercriminals — Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"},{"credibility":2,"name":"Authorities dismantle AudiA6 ransomware crypto-laundering service — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/legal/authorities-dismantle-audia6-ransomware-crypto-laundering-service/"},{"credibility":2,"name":"Operators of AudiA6 crypto laundering service arrested, charged in US — MLex","type":"news_article","url":"https://www.mlex.com/mlex/articles/2488842/operators-of-audia6-crypto-laundering-service-arrested-charged-in-us"}]},{"content":"The enforcement action resulted in the seizure and disruption of substantial assets and digital infrastructure across multiple jurisdictions. Law enforcement took down 25 domains and seized more than 30 servers located in the United States, Iceland, Germany, and France. In Georgia, authorities seized over 80 vehicles (some reports indicate 173 vehicles across all jurisdictions), multiple properties, and electronic devices. Approximately EUR 692,000 (roughly $760,000) in cryptocurrency was frozen, and an additional EUR 86,000 was seized outright. Active Telegram accounts used to operate and advertise the service were blocked. Websites for both AudiA6 and Dark2Web were replaced with law enforcement seizure banners. Authorities also published a blocklist of 19 suspicious domains to assist cryptocurrency exchanges in identifying and flagging related accounts.","heading":"Seized Assets and Infrastructure","severity":"high","sources":[{"credibility":2,"name":"Feds Seize AudiA6 and Dark2Web in $389M Crypto Laundering Case — HackRead","type":"news_article","url":"https://hackread.com/feds-seize-audia6-dark2web-crypto-laundering-case/"},{"credibility":2,"name":"Authorities dismantle crypto laundering service that moved 336 million for cybercriminals — Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"},{"credibility":2,"name":"US to seek extradition of AudiA6 duo over $389M crypto laundering scheme — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"}]},{"content":"A key finding of the investigation is that AudiA6's promised anonymity was technologically insufficient against modern blockchain forensics. Investigators, including analysts at TRM Labs, employed cluster-level demixing, timing and amount alignment, and post-mix wallet intelligence to trace funds through AudiA6's obfuscation layers. One documented example identified approximately $7 million in funds originally stolen in the LastPass breach flowing from Wasabi Wallet through AudiA6 in September 2025. The DOJ noted that all six undercover transactions conducted between December 2022 and May 2026 were directly traceable through exchange records, contradicting AudiA6's core marketing claims. TRM Labs' broader analysis of the crypto laundering ecosystem noted that cross-chain bridges have surpassed mixer volumes as the primary obfuscation mechanism, with bridge-based ransomware laundering reaching $100 million in 2025 — context that positions AudiA6 as part of a declining but still operationally active class of mixing services.","heading":"On-Chain Forensics and Traceability","severity":"medium","sources":[{"credibility":2,"name":"International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6 — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"credibility":2,"name":"Global Law Enforcement Dismantles AudiA6 Crypto Laundering Network — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/law-enforcement-dismantles-audia6-laundering-network-june-2026/"}]}],"sources_used":[{"credibility":2,"name":"Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"},{"credibility":1,"name":"Philly feds charge two with running a cryptocurrency money laundering scheme — Philadelphia Inquirer","type":"news_article","url":"https://www.inquirer.com/crime/bitcoin-crypto-money-laundering-dark-web-audia6-arrested-20260611.html"},{"credibility":2,"name":"Authorities dismantle AudiA6 ransomware crypto-laundering service — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/legal/authorities-dismantle-audia6-ransomware-crypto-laundering-service/"},{"credibility":2,"name":"Authorities dismantle crypto laundering service that moved 336 million for cybercriminals — Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"},{"credibility":2,"name":"International Operation Dismantles EUR 336 Million Ransomware Laundering Pipeline AudiA6 — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"credibility":2,"name":"Global Law Enforcement Dismantles AudiA6 Crypto Laundering Network — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/law-enforcement-dismantles-audia6-laundering-network-june-2026/"},{"credibility":2,"name":"US to seek extradition of AudiA6 duo over $389M crypto laundering scheme — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"},{"credibility":2,"name":"Feds Seize AudiA6 and Dark2Web in $389M Crypto Laundering Case — HackRead","type":"news_article","url":"https://hackread.com/feds-seize-audia6-dark2web-crypto-laundering-case/"},{"credibility":2,"name":"AudiA6 operators charged in U.S. over alleged $389m crypto laundering network — Crypto.news","type":"news_article","url":"https://crypto.news/audia6-operators-charged-in-u-s-over-alleged-389m-crypto-laundering-network/"},{"credibility":2,"name":"Operators of AudiA6 crypto laundering service arrested, charged in US — MLex","type":"news_article","url":"https://www.mlex.com/mlex/articles/2488842/operators-of-audia6-crypto-laundering-service-arrested-charged-in-us"},{"credibility":2,"name":"Ransomware Crypto Laundering Platform Taken Out by FBI and Europol — Infosecurity Magazine","type":"news_article","url":"https://www.infosecurity-magazine.com/news/ransomware-crypto-laundering/"},{"credibility":2,"name":"Europol Dismantles AudiA6 Crypto Laundering Network Used by Ransomware Gangs — CyberPress","type":"news_article","url":"https://cyberpress.org/europol-dismantles-audia6-crypto-laundering/"},{"credibility":2,"name":"Authorities Dismantle Cryptocurrency Laundering Services AudiA6 Used by Ransomware Gangs — CyberSecurityNews","type":"news_article","url":"https://cybersecuritynews.com/authorities-dismantle-audia6-services/"},{"credibility":2,"name":"11-Nation Sting Shuts AudiA6 Crypto Mixer, 336M for Ransomware — GnCrypto News","type":"news_article","url":"https://www.gncrypto.news/news/11-nation-sting-shuts-audia6-crypto-mixer-336m-ransomware/"},{"credibility":2,"name":"AudiA6 cryptocurrency service dismantled for laundering over $380 million — SC Media","type":"news_article","url":"https://www.scworld.com/brief/audia6-cryptocurrency-service-dismantled-for-laundering-over-380-million"}],"summary":"AudiA6 was a professional cryptocurrency mixing and laundering service that operated from 2021 until its dismantlement on June 10, 2026, in a coordinated international law enforcement operation. The service processed approximately 10,333 Bitcoin — valued at roughly $389 million at the time of transactions — for ransomware groups, darknet market operators, and other cybercriminals, charging commissions of 3–10%. Two alleged operators, Ruslan Igorevich Tkachuk (Ukrainian, 37) and Alexander Vladimirovich Ledenev (Russian, 25), were arrested in Batumi, Georgia, and face U.S. federal charges in the Eastern District of Pennsylvania carrying up to 20 years in prison each.","timeline":[{"date":"2021-01-01","event":"AudiA6 cryptocurrency mixing service launched, beginning to accept deposits from criminal clients on darknet forums including Dark2Web.","source":"TRM Labs / The Hacker News","source_url":"https://thehackernews.com/2026/06/europol-disrupts-audia6-crypto.html"},{"date":"2022-12-01","event":"First documented U.S. law enforcement undercover transaction with AudiA6 conducted, initiating the covert investigation phase.","source":"Philadelphia Inquirer","source_url":"https://www.inquirer.com/crime/bitcoin-crypto-money-laundering-dark-web-audia6-arrested-20260611.html"},{"date":"2023-01-01","event":"AudiA6 transaction volume peaks. Blockchain analysis later shows this as the service's highest-volume year before declining through 2024-2025.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"date":"2025-09-01","event":"Polish Police (CBZC) arrest a Ukrainian national linked to AudiA6 money laundering activities, initiating the chain of evidence that leads to the primary operators.","source":"Help Net Security","source_url":"https://www.helpnetsecurity.com/2026/06/12/europol-audia6-crypto-laundering-service-ransomware-groups/"},{"date":"2025-09-01","event":"TRM Labs identifies approximately $7 million in LastPass-stolen funds flowing from Wasabi Wallet through AudiA6, demonstrating forensic traceability.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/international-operation-dismantles-eur-336-million-ransomware-laundering-pipeline-audia6"},{"date":"2026-04-01","event":"Undercover investigators submit $5,000 in Bitcoin to AudiA6 and are charged a $300 fee; a separate transaction of $5,100 is charged a $400 fee.","source":"Philadelphia Inquirer","source_url":"https://www.inquirer.com/crime/bitcoin-crypto-money-laundering-dark-web-audia6-arrested-20260611.html"},{"date":"2026-05-01","event":"Final documented undercover transaction with AudiA6 conducted by U.S. investigators ahead of the coordinated takedown.","source":"Philadelphia Inquirer","source_url":"https://www.inquirer.com/crime/bitcoin-crypto-money-laundering-dark-web-audia6-arrested-20260611.html"},{"date":"2026-06-10","event":"Coordinated international takedown executed: Ruslan Igorevich Tkachuk and Alexander Vladimirovich Ledenev arrested in Batumi, Georgia. 25 domains seized, 30+ servers taken offline, 80+ vehicles and multiple properties confiscated. EUR 692,000 in cryptocurrency frozen.","source":"BleepingComputer / Help Net Security","source_url":"https://www.bleepingcomputer.com/news/legal/authorities-dismantle-audia6-ransomware-crypto-laundering-service/"},{"date":"2026-06-11","event":"U.S. Attorney's Office for the Eastern District of Pennsylvania publicly announces federal charges against Tkachuk and Ledenev. DOJ, Europol, and partner agencies hold joint announcement. Seizure banners placed on AudiA6 and Dark2Web websites.","source":"Philadelphia Inquirer / The Hacker News","source_url":"https://www.inquirer.com/crime/bitcoin-crypto-money-laundering-dark-web-audia6-arrested-20260611.html"},{"date":"2026-06-13","event":"U.S. Attorney's Office confirms it will seek extradition of both defendants from Georgia to the Eastern District of Pennsylvania. Both remain in Georgian custody.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/us-extradition-audia6-duo-crypto-laundering/"}]},"v":1}